IBM IBM Certified Deployment Professional C2150-400 Questions & Answers

• Question 121:

  Which option will display the rule that triggered an offense from Offense Details screen?

  A. Display > Rules

  B. Display > Sources

  C. Offenses tab > Rules

  D. Display > Annotations

  Correct Answer: A

• Question 122:

  A mail server typically communicates with 50 hosts per second in the middle of the night and then suddenly starts communicating with 1.000 hosts a second. The administrator wants to get an email alert whenever this situation is being observed.

  Which type of rule should an administrator create to monitor this situation?

  A. Flow Rule

  B. Anomaly Rule

  C. Threshold Rule

  D. Behavioral Rule

  Correct Answer: C

• Question 123:

  Which command will install the patch after mounting the patch file?

  A. /media/updates/setup

  B. /media/updates/installer

  C. /media/updates/setup -patch

  D. /media/updates/installer -patch

  Correct Answer: B

• Question 124:

  What does QRadar use to group the event or flow according to the network?

  A. Network mapping

  B. Network hierarchy

  C. Application mapping

  D. Application hierarchy

  Correct Answer: A

• Question 125:

  There are unknown log records from unsupported security device events in the Log activity tab. You are planning to write an LSX for an unsupported security device type based on UDSM. What is the file format and payload option for exporting the unknown log records?

  A. XLS and full export

  B. CSV and full export

  C. XML and visible column

  D. PDF and visible column

  Correct Answer: C

• Question 126:

  What type of users can view all reports that are created by other users?

  A. Auditors

  B. Analysts

  C. Managers

  D. Administrators

  Correct Answer: D

• Question 127:

  What does the message in the System Notification Widget on the Dashboard "Disk sentry: System disk usage back to normal levels." tell you?

  A. One of your File Systems has been reduced to below 92%.

  B. One of your File Systems has been reduced to below 95%.

  C. One of your File Systems has been reduced to below 98%.

  D. One of your File Systems has been reduced to below 90%.

  Correct Answer: A

• Question 128:

  A QRadar administrator is sizing a distributed deployment. The deployment has approximately 2 million flows per minute (FPM) and needs at least 7 terabytes of storage.

  Which architecture is correct?

  A. One 1724 flow processor

  B. One 1705 flow processor

  C. Two 1724 flow processors

  D. Two 1705 flow processors

  Correct Answer: C

• Question 129:

  A customer has a requirement to integrate with QRadar to capture events coming from IBM DB2.

  Which protocol should an administrator use to integrate Log Enhanced Event format (LEEF) events while configuring Log Sources on QRadar console?

  A. JDBC

  B. SNMP

  C. Syslog

  D. Log File

  Correct Answer: C

• Question 130:

  Which three tasks can an administrator perform from the QRadar SIEM reports tab? (Choose three.)

  A. Brand reports

  B. Ability to create custom reports

  C. Ability to create custom compliance templates

  D. Present statistics derived from source IP and destination IP

  E. Present measurements and statistics derived from real time data

  F. Present measurements and statistics derived from events, flows and offenses

  Correct Answer: BDF