IBM IBM Certifications C2150-624 Questions & Answers

• Question 91:

  Which permission can be assigned to a user from User Roles in the IBM Security QRadar SIEM V7.2.8 Console?

  A. Admin

  B. DSM Updates

  C. Flow Activity

  D. Configuration Management

  Correct Answer: A

  Grants administrative access to the user interface. You can grant specific Admin permissions. Users with System Administrator permission can access all areas of the user interface. Users who have this access cannot edit other administrator accounts.

• Question 92:

  An IBM Security QRadar SIEM V7.2.8 Administrator needs to download a nightly configuration backup file

  from a past day through the Web Console.

  Which steps must be followed to achieve this?

  A. Admin Tab -> System Configuration -> Backup and Recovery -> Generate new backup -> Save

  B. Admin Tab -> System Configuration -> Backup and Recovery ->Choose the name of an Existing backup

  C. Admin Tab -> System Configuration -> Backup and Recovery -> Import New Backup -> Select file extension -> Save

  D. Admin Tab -> System Configuration -> System Settings -> Database Settings -> Choose the name of an Existing backup

  Correct Answer: B

  The backups are listed in Backup and recovery section of the system configuration in the admin tab. You can click on the existing backup and it will show you the options to download it.

• Question 93:

  The Administrator of an IBM Security QRadar SIEM V7.2.8 deployment needs to determine which rules

  are most active in generating offenses.

  How would the Administrator accomplish this from the Offenses tab of the QRadar console?

  A. Rules -> Group -> "Most Active Offenses".

  B. Rules -> Rules -> Offense Count to reorder the column in descending order.

  C. All Offenses -> All Offenses -> Offense Count to reorder the column in descending order.

  D. All Offenses -> All Offenses -> Events to reorder the column in descending order. Use the Actions menu to view the rule information for a specific offence.

  Correct Answer: B

  1.

  Click the Offenses tab.

  2.

  On the navigation menu, click Rules. To determine which rules are most active in generating offenses, from the rules page, click Offense Count to reorder the column in descending order.

  3.

  Double-click any rule to display the Rule Wizard. You can configure a response to each rule.

• Question 94:

  An Administrator working with IBM Security QRadar SIEM V7.2.8 needs to assign a report to a group

  named Network Management.

  What is the process for this task to be completed?

  A. Reports Tab -> Select report -> Actions -> Assign Groups -> Item Groups -> select Network Management -> Assign Groups

  B. Admin Tab -> Report Permissions -> select report -> Actions -> Assign Groups -> select Network Management -> Assign

  C. Reports Tab -> Select report -> Actions -> Assign Users -> User Groups -> select Network Management -> Assign Users

  D. Admin Tab -> Report Permissions -> select report -> Actions -> Assign Users -> select Network Management -> Assign

  Correct Answer: A

  You can use the Assign Groups option to assign a report to another group

  1.

  Click the Reports tab.

  2.

  Select the report that you want to assign to a group.

  3.

  From the Actions list box, select Assign Groups.

  4.

  From the Item Groups list, select the check box of the group you want to assign to this report.

  5.

  Click Assign Groups

• Question 95:

  Which is an officially supported operating system for IBM Security QRadar SIEM V7.2.8 installations on customer supplied hardware?

  A. Ubuntu Linux

  B. Windows 2012

  C. Fedora Linux

  D. Red Hat Enterprise Linux

  Correct Answer: D

  The IBM Security QRadar Application Framework SDK can be installed on Windows, Linux, or OSX operating system.

• Question 96:

  The event data collected by IBM Security QRadar SIEM V7.2.8 is being deleted after one month. The legal

  department required the data be kept for two months.

  What can the administrator do to accommodate this requirement?

  A. Change the nightly backup Priority to "High".

  B. Change the nightly backup to a monthly backup.

  C. Change the Default Event Retention Policy property field "Do not delete data in this bucket" to two months.

  D. Change the Default Event Retention Policy property field "Keep data placed in this bucket for" to two months.

  Correct Answer: D

  When storage space is required - Select this option if you want events or flows that match the Keep data placed in this bucket for parameter to remain in storage until the disk monitoring system detects that storage is required. If used disk space reaches 85% for records and 83% for payloads, data will be deleted. Deletion continues until the used disk space reaches 82% for records and 81% for payloads.

  When storage is required, only events or flows that match the Keep data placed in this bucket for parameter are deleted.

• Question 97:

  When an IBM Security QRadar SIEM V7.2.8 distributed deployment requires scaling horizontally to achieve Event per Second (EPS) requirements, what QRadar Component needs to be added to meet the EPS demands?

  A. Event Manager

  B. Event Indexing

  C. Event Collector

  D. Event Processor

  Correct Answer: D

• Question 98:

  When it comes to licensing, what is the difference between Events and Flows and how they are licensed?

  A. Flows are licensed based on overall count over a minute, where Events are licensed based on overall count per second.

  B. Flows are licensed based on overall count per second, where Events are licensed based on overall count over a minute.

  C. Flows and Events are both licensed by overall count per minute under an Upgraded License and per second on a Basic License.

  D. Flows and Events are both licensed by overall count per second under an Upgraded License and per second on a Basic License.

  Correct Answer: A

  A significant difference between event and flow data is that an event, which typically is a log of a specific action such as a user login, or a VPN connection, occurs at a specific time and the event is logged at that time. A flow is a record of network activity that can last for seconds, minutes, hours, or days, depending on the activity within the session. For example, a web request might download multiple files such as images, ads, video, and last for 5 to 10 seconds, or a user who watches a Netflix movie might be in a network session that lasts up to a few hours. The flow is a record of network activity between two hosts.

• Question 99:

  An Administrator working with IBM Security QRadar SIEM V7.2.8 needs to delete a single value named

  User1 from a reference set with the name "Allowed Users" from the command line interface.

  Which command will accomplish this?

  A. ./UtilReferenceSet.sh purge "Allowed Users" User1

  B. ./ReferenceSetUtil.sh purge "Allowed Users" User1

  C. ./ReferenceSetUtil.sh delete "Allowed\ Users" User1

  D. ./UtilReferenceSet.sh delete "Allowed\ Users" User1

  Correct Answer: B

  The Referencesetutil.sh purge is the correct syntax of the command. It deletes the specific user when you mention it within the reference set.

• Question 100:

  An Administrators will add a secondary host to an IBM Security QRadar SIEM V7.2.8 Console in a High

  Availability (HA) deployment scenario.

  After checking the compatibility between primary and secondary HA pairs, what other prerequisite should

  the Administrator check within Managed Interfaces?

  A. The shared external storage.

  B. The server certificate that is issued by the local CA.

  C. The existence of an additional distributed file system.

  D. The communication for Distributed Replicated Block Device.

  Correct Answer: D

  CP port 7789 must be open and allow communication between the primary and secondary for Distributed

  Replicated Block Device (DRBD) traffic.

  DRBD traffic is responsible for disk replication and is bidirectional between the primary and secondary

  host.