1. Home
  2. IBM
  3. C1000-026

IBM Security QRadar SIEM V7.3.2 Fundamental Administration

Exam Details

  • Exam Code
    :C1000-026
  • Exam Name
    :IBM Security QRadar SIEM V7.3.2 Fundamental Administration
  • Certification
    :IBM Certifications
  • Vendor
    :IBM
  • Total Questions
    :60 Q&As
  • Last Updated
    :Apr 13, 2025

IBM IBM Certifications C1000-026 Questions & Answers

  • Question 51:

    An administrator needs to add the following networks to a QRadar network hierarchy as a single Classless Inter-Domain Routin (CIDR) range:

    192.168.64.0/24 192.168.65.0/24 192.168.66.0/24 192.168.67.0/24

    What is the correct supernet for these subnets?

    A. Network 192.168.66.0 with subnet mask 255.255.252.0

    B. Network 192.168.64.0 with subnet mask 255.255.252.0

    C. Network 192.168.64.0 with subnet mask 255.255.255.0

    D. Network 192.168.66.0 with subnet mask 255.255.252.0

  • Question 52:

    An administrator needs to import a list of HR staff logins into a reference set.

    Which file type can be used with the import function in the reference set editor window?

    A. xml

    B. csv

    C. xls

    D. json

  • Question 53:

    An administrator is about to integrate logs from a custom firewall in a QRadar deployment using syslog. The SIEM has two domains, namely Domain A and Domain B. While reviewing the following sample logs, the administrator notices a "context" keyword:

    May 14 11:05:01 192.168.1.23 20190514 11:05:00 context=contextA permit 192.168.1.24 source: 10.10.1.15; source_port: 64094; destination: 10.10.13.34; service: 53; protocol: udp;

    May 13 12:07:01 192.168.1.23 20190513 11:07:00 context=contextB permit 192.168.1.25 source: 10.10.1.15; source_port: 64094; destination: 10.10.13.34; service: 53; protocol: udp;

    Which options assign the "contextA" logs to DomainA and the "contextB" logs to domain B? (Choose two.)

    A. Create a single log source, create a "Context" custom event property, and assign the log to both domains using a custom rule.

    B. Create two individual log sources by configuring a separated logging instance for each context on the firewall and assign each log source to the correct domain.

    C. Create a single log source, create a "Context" custom event property, and assign the log to the correct domain using custom event property value.

    D. Create two individual log sources using the context value as log source identifier and assign each log source to the correct domain.

    E. Create a single log source, create a "Context" custom event property, and assign the log to the correct domain using a custom rule.

  • Question 54:

    An administrator is seeing the following system notification:

    38750057 – A protocol source configuration may be stopping events from being collected.

    What is a valid user action to this issue?

    A. Re-install the QRadar Console

    B. Review the /var/log/qradar.log file for more information

    C. Restart the QRadar Console

    D. Review the /var/log/error.log file for more information

  • Question 55:

    Which event routing rule is required to add QRadar Data Store (QDS) capability to a deployment?

    A. Log Only (exclude Analytics)

    B. Delete data When storage space is required

    C. Bypass Correlation

    D. Delete data immediately after the retention period has expired

  • Question 56:

    A QRadar administrator added High Availability (HA) to the Event Processor and needs to verify the crossover link status between the primary and secondary hosts.

    Which commands can be used to verify the crossover status? (Choose two.)

    A. /opt/qradar/ha/bin/ha_getstate.sh

    B. /opt/qradar/ha/bin/getStatus crossover

    C. /opt/qradar/ha/bin/qradar_nettune.pl crossover status

    D. /opt/qradar/ha/bin/qradar_nettune.pl linkaggr status

    E. /opt/qradar/ha/bin/ha cstate

    F. cat /proc/drbd

  • Question 57:

    To comply with specific regulations, an administrator has been requested to increase asset retention to 365 days.

    In which QRadar section can the administrator find the asset retention settings?

    A. Admin Tab / Asset Retention

    B. Assets Tab / Retention settings

    C. Admin Tab / System settings

    D. Assets Tab / Asset Retention

  • Question 58:

    An administrator needs to know if a custom rule is being correlated correctly. Which QRadar component is responsible for this process?

    A. QRadar Event Collector

    B. QRadar Console

    C. Magistrate

    D. QRadar Event Processor

  • Question 59:

    An administrator needs to collect logs from the Command Line Interface (CLI). Which command should the administrator use?

    A. /opt/bin/qradar/support/get_logs.sh

    B. /opt/support/get_logs.sh

    C. /opt/support/qradar/get_logs.sh

    D. /opt/qradar/support/get_logs.sh

  • Question 60:

    An administrator needs to import data into QRadar for a specific use case.

    The data that has been provided to the administrator is stored in records that map a key to a value.

    Which type of data collection must the administrator create?

    A. Reference set

    B. Reference map of sets

    C. Reference map

    D. Reference map of maps

Related Exams:

Tips on How to Prepare for the Exams

Nowadays, the certification exams become more and more important and required by more and more enterprises when applying for a job. But how to prepare for the exam effectively? How to prepare for the exam in a short time with less efforts? How to get a ideal result and how to find the most reliable resources? Here on Vcedump.com, you will find all the answers. Vcedump.com provide not only IBM exam questions, answers and explanations but also complete assistance on your exam preparation and certification application. If you are confused on your C1000-026 exam preparations and IBM certification application, do not hesitate to visit our Vcedump.com to find your solutions here.