IBM IBM Certified Deployment Professional C2150-400 Questions & Answers

• Question 111:

  Which two proxy options are required to be set when using a Proxy Server for Auto Updates in QRadar? (Choose two.)

  A. Proxy Type

  B. Proxy Name

  C. Proxy Schedule

  D. Proxy Server URL

  E. Proxy Port number

  Correct Answer: BD

• Question 112:

  What does Server discovery allow the QRadar administrator to do?

  A. Discover

  B. Define rules for hosts

  C. Create host searches

  D. Populate host definition building blocks

  Correct Answer: A

• Question 113:

  Which statement is true with regard to planning QRadar SIEM high availability?

  A. The secondary host can be in different subnet as the primary host.

  B. The secondary HA host that you want to add to the HA cluster can be a component in another HA cluster.

  C. The primary HA host that you want to add to the HA cluster must be a component in another HA cluster.

  D. When the IP address of the primary host is reassigned as a cluster virtual IP, the new IP address that you assign to the primary must be in the same subnet.

  Correct Answer: D

• Question 114:

  Which IP address of a NATed server is used to access the server from outside the network?

  A. Public IP address

  B. Private IP address

  C. Cluster IP address

  D. Secondary IP address

  Correct Answer: A

• Question 115:

  You notice the following message in the System Notification Widget on the Dashboard:

  "Unable to automatically detect the associated log source for IP address."

  When you hover over the message, you see this pop-up message:

  

  What is the issue?

  A. There are events coming from IP 127.0.0.1 that cannot be autodiscovered and a Log Source Created

  B. There are events coming from IP 192.168.2.90 that cannot be autodiscovered and a Log Source Created

  C. There are events coming from IP 172.16.77.25 that cannot be autodiscovered and a Log Source Created

  D. There are events coming from hostname red6.color.com that cannot be autodiscovered and a Log Source Created

  Correct Answer: C

• Question 116:

  What functionalities of QRadar provide the ability to collect, understand, and properly categorize events from external sources?

  A. Log sources

  B. Flow sources

  C. Syslog sources

  D. External sources

  Correct Answer: A

• Question 117:

  What is a benefit of enabling indexes on event properties?

  A. Improved Offense Correlation

  B. Improved search performance

  C. Improved Performance of Custom Rules

  D. Improved accuracy of auto-discovery log sources

  Correct Answer: B

• Question 118:

  From the given event payload format:

  

  You are tasked with creating a Reference Set of the second IPs in the payload.

  What needs to be done to complete this task?

  A. Create a Custom Event Property to parse the second IP in the payload. From the Log Source config for the above event, choose "add to reference set" and select your reference set.

  B. From the Reference Set Management screen, select "create reference set from Log Source Event". Pick the Log Source from the drop down. Pick the Event Name from the drop down.

  C. From the Reference Set Management screen, select "create reference set from Log Source Event". Pick the Log Source from the drop down. Pick the Custom Event Property from the drop down.

  D. Create a Custom Event Property to parse the second IP in the payload. Create a rule that tests for events from the Log Source that is collecting the above event, and for Rule Response add the Custom

  Event Property to the Reference Set.

  Correct Answer: A

• Question 119:

  What should be the latency between the primary and secondary HA hosts?

  A. Less than 1 millisecond

  B. Less than 2 milliseconds

  C. Less than 3 milliseconds

  D. Less than 4 milliseconds

  Correct Answer: B

• Question 120:

  Which two search filters are available on the QRadar console while making an asset search? (Choose two.)

  A. PCI Severity. NERC Severity

  B. Vulnerability CVSS Base Score. Vulnerability Risk Score

  C. Vulnerability on Open Port, Vulnerability on Open Service

  D. Vulnerability on Open Port, Vulnerability External Reference

  E. Vulnerability on Source Port, Vulnerability on Destination Port

  Correct Answer: BE