IBM IBM Certifications C1000-018 Questions & Answers

• Question 31:

  Which consideration should be given to the position of rule tests that evaluate regular expressions (Regex tests)?

  A. They can only be used in Building Blocks to ensure they are evaluated as infrequently as possible.

  B. They are usually the most specific. As such, they should appear first in the order.

  C. They are usually the most expensive. As such, they should appear last in the order.

  D. They are stateful tests. As such QRadar automatically evaluates them last.

  Correct Answer: A

  Reference: https://towardsdatascience.com/everything-you-need-to-know-about-regular-expressions8f622fe10b03

• Question 32:

  An analyst needs to perform Offense management.

  In QRadar SIEM, what is the significance of “Protecting” an offense?

  A. Escalate the Offense to the QRadar administrator for investigation.

  B. Hide the Offense in the Offense tab to prevent other analysts to see it.

  C. Prevent the Offense from being automatically removed from QRadar.

  D. Create an Action Incident response plan for a specific type of cyber attack.

  Correct Answer: C

  Explanation:

  Protecting offenses:

  You might have offenses that you want to retain regardless of the retention period. You can protect

  offenses to prevent them from being removed from QRadar after the retention period has elapsed.

  Reference: https://www.ibm.com/docs/en/SS42VS_7.3.2/com.ibm.qradar.doc/b_qradar_users_guide.pdf

• Question 33:

  What could be a possible reason that events are routed directly to storage by the custom rule engine (CRE)?

  A. System is under high load

  B. A rule is processing 20,000 EPS

  C. Event normalization issue

  D. Event Parsing issue

  Correct Answer: A

• Question 34:

  What is the purpose of Anomaly detection rules?

  A. They inspect other QRadar rules.

  B. They detect if QRadar is operating at peak performance and error free.

  C. They detect unusual traffic patterns in the network from the results of saved flow and events.

  D. They run past events and flows through the Custom Rules Engine (CRE) to identify threats or security incidents that already occurred.

  Correct Answer: C

  Reference: https://www.juniper.net/documentation/en_US/jsa7.4.0/jsa-users-guide/topics/concept/conceptjsa-user-anomaly-detection-rules.html#:~:text=Anomaly%20detection%20rules%20test%20the,patterns% 20occur%20in%20your%20network.andtext=Typically%20the%20search%20needs%20to,%2C%

  20thresholds%2C%20or%20behavior%20changes

• Question 35:

  What is the intent of the magnitude of an offense?

  A. It measures the age of the event attached to the offense.

  B. It measures the age of the offense.

  C. It measures the importance of the offense.

  D. It measures the importance of the event attached to the offense.

  Correct Answer: B

  Explanation:

  The age of the offense.

  Reference: https://www.ibm.com/docs/en/qsip/7.3.3?topic=management-offense-prioritization

• Question 36:

  How many normalized timestamp field(s) does an event contain?

  A. 2

  B. 3

  C. 4

  D. 1

  Correct Answer: B

  Explanation:

  There are 3 timestamp fields on events in Qradar.

  Reference: https://www.ibm.com/mysupport/s/question/0D50z00006PEG2mCAH/why-do-i-see-differenttime-stamps-for-qradar-events?language=en_US

• Question 37:

  While creating a new custom property, which is a valid property type selection?

  A. Flow Based

  B. Event Based

  C. AQL Based

  D. Regular Expressions Based

  Correct Answer: D

• Question 38:

  The graph below shows a time series of a value. A rule has been created which will trigger at the indicated point.

  

  Which type of QRadar rule has been used?

  A. Common Rule

  B. Threshold Rule

  C. Behavioral Rule

  D. Anomaly Rule

  Correct Answer: B

• Question 39:

  When an Offense is triggered, it only shows the events that triggered the Offense. The analyst wants to investigate further to see more events around the incident, not only those that triggered the Offense. The analyst clicks on the event count and sees the events belonging to the Offense.

  How can the analyst proceed to see a more detailed picture of what occurred?

  A. Right-click on the source IP, and choose More Options, then Information, and then Search Events.

  B. Right-click on the destination IP, and choose More Options, then Raw Events.

  C. Right-click on the source IP, and choose View in DSM Editor.

  D. Right-click and filter on the Destination IP.

  Correct Answer: D

  Reference: https://www.ibm.com/docs/en/qradar-on-cloud?topic=events-filtering

• Question 40:

  Which filter would an analyst apply in the Log Activity tab to get a list of log sources not reporting to QRadar?

  A. Log source status does not equal active

  B. Custom rule equals device stopped sending events

  C. Log source type does not equal active

  D. Log source status does not equal error

  Correct Answer: A