IBM IBM Certified Deployment Professional C2150-400 Questions & Answers

• Question 1:

  Which icon on the Admin tab do you select when setting up QRadar to use an external authentication method?

  A. Users

  B. Authentication

  C. System Settings

  D. Authorized Services

  Correct Answer: C

• Question 2:

  A QRadar administrator is developing custom uDSM's for an unsupported device. Given this event payload:

  <13> Jan 28 12:57:23 9.77.16.19 AgentDevice=FileForwarder AgentLogFile=logger1.log Payload=January 28,2014 12:53:50 PM GMT+05:30|HOST_CREATE_ERROR|Host{1:testserver40} create failed on array {0:Abc}

  Which regular expression should the administrator define for parsing the hostname "testserfvefr40"?

  A. \w+\s+{.*?\\s}

  B. \w+\s+{\d+\:(\.*?)\}

  C. \w+\s+{\d+\:(\w+)\}

  D. \w+\s+{\d+\:([a-zA-Z]+)\}

  Correct Answer: D

• Question 3:

  A customer has configured NetApp storage device to send events to QRadar SIEM. The customer wants an alert to be generated whenever error messages (Improper power supply in the shelf for NetApp device) appear on the console.

  How can a QRadar administrator generate the alert whenever error message appear on the QRadar console?

  A. Offenses > Rules > Actions > New Event Rule

  B. Offenses > Rules > Click on Rule Wizard Button

  C. Admin Tab > Rule Management > New Event Rule

  D. Admin Tab > Rule Management > Actions > New Event Rule

  Correct Answer: A

• Question 4:

  A customer is observing the Asset tab on the QRadar console and is getting duplicate assets in the console.

  What is the reason for this asset duplication?

  A. There are multiple heterogeneous assets present in environment.

  B. There are multiple assets having same configuration details present in environment.

  C. QRadar creates duplicate assets after a specific periodic interval without considering asset activity or inactivity.

  D. Asset doesn't appear in network for specific time period; when it came back QRadar detects it and

  created a new asset for the same.

  Correct Answer: C

• Question 5:

  Which statement is correct for patching an HAed server?

  A. If the Secondary host is in an Active state, the patch should be applied to the Secondary.

  B. The patch should be applied to the Primary first and the patch should be applied to the Secondary.

  C. Remove Secondary, then apply the patch on Primary, and then add the Secondary again.

  D. Run the patch on the Primary and the Secondary will be updated Automatically.

  Correct Answer: B

• Question 6:

  Which two fields are required to be filled out when adding a new network to the network hierarchy? (Choose two.)

  A. Group

  B. Country

  C. Mail Server

  D. DNS Server

  E. IP and CIDR

  Correct Answer: DE

• Question 7:

  Which statement is true with regard to auto discovery functionality?

  A. All supported DSMs are auto discovered.

  B. Only 50 Log Sources can be auto discovered.

  C. Auto discovered log sources are assigned to a generic log source group.

  D. QRadar license key defines the maximum number of log sources that can be auto discovered.

  Correct Answer: C

• Question 8:

  Which action can be performed on a license key?

  A. Erase a license key

  B. Delete a license key

  C. Unload a license key

  D. Unallocate a license key

  Correct Answer: B

• Question 9:

  In QRadar SIEM, customer wants to tune one of the firewall deny event which shows firewall deny for all events coming from a Syslog Server and has been identified as false positive. The customer clicked on the "false positive" button to tune the specific event.

  What are the traffic directions that will be available during declaring this event as a false positive? (Choose two.)

  A. SourceIP to Local Network

  B. SourceIP to Any Destination

  C. Any source to Any Destination

  D. Destination IP to Local Network

  E. Source IP to Destination Network

  Correct Answer: BE

• Question 10:

  Which view option allows you to view events as they occur?

  A. Automatic

  B. Live Events

  C. Real Time (streaming)

  D. Last Interval (auto refresh)

  Correct Answer: C