IBM IBM Certifications C2150-624 Questions & Answers

• Question 11:

  Which two options are available when you create a security profile in IBM Security QRadar SIEM V7.2.8? (Choose two.)

  A. Events and Flows

  B. Databases and Network

  C. Network and Log Sources

  D. Log Sources and Databases

  Correct Answer: C

• Question 12:

  What IBM Security QRadar SIEM V7.2.8 component can be added to Flow and Event Processors to increase processing capacity and memory, for enhancing search performance?

  A. Data Node

  B. Data Indexer

  C. QFlow Collector

  D. Advanced Correlation Engine

  Correct Answer: C

• Question 13:

  IBM Security QRadar SIEM V7.2.8 collects network activity information. This information represents

  network activity by normalizing IP addresses, ports, byte and packet counts, as well as other details, which

  effectively represent a session between two hosts.

  This defines what type of information?

  A. Flow Record information

  B. Event Record Information

  C. Data Source Information set up to a database from a server

  D. A failed login action of a Virtual Private Network (VPN) session

  Correct Answer: A

• Question 14:

  Given the following RegEx: (\b\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\b) What data does this expression extract?

  A. URL

  B. User Name

  C. IP address

  D. Email Address

  Correct Answer: C

• Question 15:

  Which is an officially supported web browser for managing IBM Security QRadar SIEM V7.2.8?

  A. Safari

  B. Vivaldi

  C. Opera Netscape

  D. Mozilla Firefox ESR

  Correct Answer: D

• Question 16:

  An Administrator working with IBM Security QRadar SIEM V7.2.8 wants to view the general statistics of all

  hosts in the Distributed Environment.

  Where can the Administrator find this information?

  A. Admin tab -> System Status -> System Health

  B. Admin tab -> General Settings -> System Health

  C. Admin tab -> System Configuration -> System Health

  D. Admin tab -> System Configuration -> System Statistics

  Correct Answer: C

• Question 17:

  An Administrator working with a IBM Security QRadar SIEM V7.2.8 deployment needs to build an Ariel

  Query to find all events data received in the last 24 hours where the magnitude of the events is larger than

  1 but smaller than 5.

  What Query needs to be used?

  A. SELECT * FROM events WHERE magnitude > 1 AND < 5 LAST 1 DAYS

  B. SELECT * FROM events WHERE magnitude BETWEEN 1 AND 5 LAST 1 DAYS

  C. SELECT * FROM eventstable WHERE magnitude BETWEEN 1 and 5 LAST 1 DAYS

  D. SELECT * FROM eventstable WHERE magnitude BETWEEN 1 AND 5 LAST 1 DAYS

  Correct Answer: A

• Question 18:

  An IBM Security QRadar SIEM V7.2.8 Administrator generates offenses by testing Event and Flow

  conditions. To investigate QRadar offenses, the Administrator must view the Rules that created the

  offense. The Administrator is in the Offenses Tab viewing All Offenses.

  What is the procedure to accomplish this task?

  A. On the toolbar -> Actions -> Settings -> Add the Rules Column if necessary -> Rules Column to reorder by Rules

  B. Double Click the offense -> Action -> Rules -> From the List of Rules Contributing to Offense pane Double Click the Rule Name

  C. Double Click the offense -> Display -> Rules -> From the List of Rules Contributing to Offense pane Double Click the Rule Name

  D. On the toolbar -> Actions -> Settings -> Add the Rules Column if necessary -> Rules Column to reorder by Rules -> Double Click the offense -> Display -> Rules -> From the List of Rules Contributing to Offense pane Double Click the Rule Name

  Correct Answer: D

• Question 19:

  How are Events and Flows licensed in IBM Security QRadar V7.2.8?

  A. They are both licensed in a `per minute' value.

  B. They are both licensed in a `per second' value.

  C. Events are licensed as a `per second' value and Flows as a `per minute' value.

  D. Events are licensed as a `per minute' value and Flows as a `per second' value.

  Correct Answer: D

• Question 20:

  An Administrator is creating custom rules and configuring log sources on an IBM Security QRadar SIEM

  V7.2.8 console. This data needs to be retained so that it can be recovered in case of any system failure

  with minimal effort.

  Which option can the Administrator utilize from the Backup and Recovery Wizard to accomplish this task?

  A. Data backups

  B. Ariel database

  C. Configuration and Data backups

  D. Configuration and DB2 database

  Correct Answer: A