IBM IBM Certified Deployment Professional C2150-400 Questions & Answers

• Question 61:

  Which Network Address Translation (NAT) is necessary to enable NAT for a Managed Host?

  A. Static NAT translation

  B. Active NAT translation

  C. Variable NAT translation

  D. Dynamic NAT translation

  Correct Answer: A

• Question 62:

  Which Security Profile Permission Precedence should be applied so the users of that profile can only see the flows related to the "Windows Servers" network?

  A. Network Only

  B. No Restrictions

  C. Log Sources Only

  D. Network AND Log Source

  Correct Answer: D

• Question 63:

  Which TCP port must be open to allow communication between the primary and secondary HA hosts?

  A. 7709

  B. 7788

  C. 7789

  D. 7790

  Correct Answer: C

• Question 64:

  Which offboard storage solution utilizes Ethernet infrastructure rather than a dedicated SAN network?

  A. FTP

  B. NFS

  C. iSCSI

  D. Fibre Channel

  Correct Answer: C

• Question 65:

  Which proxy option can be set in the QRadar Auto Update Advanced settings?

  A. Proxy Type

  B. Proxy Name

  C. Proxy Schedule

  D. Proxy Password

  Correct Answer: D

• Question 66:

  A user of QRadar wishes to have a report showing the total bytes seen on their Internet connection. The user decides to create a Custom Flow Property to add the bytes sent and bytes received together.

  Which type of custom property is required for this to be accomplished?

  A. Regex Custom Property

  B. Computed Custom Property

  C. Arithmetic Based Custom Property

  D. Calculation Based Custom Property

  Correct Answer: B

• Question 67:

  Which tab can used to create, edit, distribute and manage reports?

  A. Admin

  B. Assets

  C. Reports

  D. Dashboard

  Correct Answer: C

• Question 68:

  Which operating system is supported for creating a bootable flash drive for recovery?

  A. IBM AIX

  B. MAC OS X

  C. Ubuntu Linux

  D. Windows OS

  Correct Answer: C

• Question 69:

  A QRadar administrator is sizing a distributed deployment. The deployment has approximately 25,000 events per second and needs at least 7 terabytes of storage.

  Which architecture is correct?

  A. One 1605 event processor

  B. One 1624 event processor

  C. Two 1605 event processors

  D. Two 1624 event processors

  Correct Answer: C

• Question 70:

  Assuming a Squid Proxy has logs in the following format:

  time elapsed remotehost code/status bytes method URL rfc931 peerstatus/peerhost type And these are some sample logs from Squid server:

  1286536310.075 452 192.168.0.227 TCP_MISS/200 5067 GET http://www.test.com/vi/VfnuY/default.jpgDIRECT/10.20.153.118 image/jpeg 1286536310.524 935 192.168.0.68 TCP_MISS/200 1021 POST http://www.test.com/services DIRECT/172.16.41.128 application/xml 1286536310.550 495 192.168.0.227 TCP_MISS/204 406 GET http://test.com/get_video? DIRECT/10.12.231.1.136 text/html 1153239176.287 632 172.16.10.92 TCP_IMS_HIT/304 215 GET http:// www.test.com/index.html - NONE/-text/html

  Which regular expression would you use to pull out the bytes field into custom property?

  A. \w+/\d+\s+(\d+)\s+(POST|GET)

  B. \w+/\d+\S+(\d+)\S+(POST|GET)

  C. \w+/\d+\s+(\d+)\s+^(POST|GET)

  D. \W+/\D+\D+(\D+)\D+(POST|GET)

  Correct Answer: D