IBM IBM Certifications C2150-624 Questions & Answers

• Question 31:

  An IBM Security QRadar SIEM V7.2.8 deployment configured with High-Availability (HA) has both a

  primary and secondary host. The administrator needs to test the operation of the primary high-availability

  (HA) host automatic failover to the secondary HA host.

  What must be configured to accomplish this test?

  A. Configure the time interval of heartbeat timeout tests so the secondary HA host receives a response from the primary HA host within 2 minutes.

  B. Configure the time interval of heartbeat timeout tests so the secondary HA host does not receive a response from the primary HA host within 2 minutes.

  C. Configure the time interval of heartbeat ping tests so the secondary HA host receives a response from the primary HA host within a preconfigured time period.

  D. Configure the time interval of the heartbeat ping tests so the secondary HA host does not receive a response from the primary HA host within a preconfigured time period.

  Correct Answer: C

• Question 32:

  A backup failure occurs on an IBM Security QRadar SIEM V7.2.8 Console or on an Event Processor. Which system notification message can an Administrator configure for an email notification?

  A. Backup: requires more disk space

  B. Backup: unable to process backup request

  C. Backup: last Backup exceeded space threshold

  D. Backup: last Backup reached execution threshold

  Correct Answer: A

  Reference: http://www-01.ibm.com/support/docview.wss?uid=swg21691524

• Question 33:

  An IBM Security QRadar SIEM V7.2.8 Administrator is implementing a retention policy of flows and events.

  The retention buckets are sequenced in priority order from the top row to the bottom row.

  What happens if a record does not match any of the configured retention buckets?

  A. The record is dropped and is not stored

  B. The record is stored in the default retention bucket

  C. The record is stored in a raw format inside /default partition

  D. The record is stored in any of the available retention buckets

  Correct Answer: B

• Question 34:

  When upgrading IBM Security QRadar SIEM V7.2.8 in High Availability (HA) deployments, how can the upgrade be automatically applied to the associated secondary system(s)?

  A. Issue the command on the primary system /media/updates/installer -HA

  B. Confirm the system setting on both the primary and secondary systems are set to "Upgrade YES"

  C. Make sure the primary system is the active system and the secondary system is in standby mode

  D. Make sure the primary system is the active system and the secondary system is in failover mode

  Correct Answer: C

• Question 35:

  An Administrator working with IBM Security QRadar SIEM V7.2.8 has to add a new host name to a

  reference set with the name "Allowed Hosts" from the command line interface.

  Which command would accomplish this task?

  A. ./ReferenceSetUtil.sh add Allowed\ Hosts computer.domain.com

  B. ./UtilReferenceSet.sh add "Allowed Hosts" "computer.domain.com"

  C. ./UtilReferenceSet.sh update Allowed\ Hosts "computer.domain.com"

  D. ./ReferenceSetUtil.sh update "Allowed Hosts" "computer.domain.com"

  Correct Answer: A

• Question 36:

  What must be done when creating a user with a non-admin role on an IBM Security QRadar SIEM V7.2.8 system that is utilizing Active Directory authentication?

  A. Ensure the password has a minimum of 8 characters.

  B. Create the user's initial password and have them change it immediately.

  C. Ensure the user's QRadar password matches their Active Directory password.

  D. A password does not need to be set on QRadar when using Active Directory authentication.

  Correct Answer: C

• Question 37:

  The following error message is displayed when an Administrator attempts to log in to the IBM Security

  QRadar SIEM V7.2.8 environment with a known valid Active Directory (AD)account:

  "The username and password you supplied are not valid. Please try again."

  What procedure should be followed to find the problem?

  A. Run the command "adconn -q " and see if the machine can connect to the AD Servers.

  B. Run the command "setaddate -q " to synchronize the system time of the QRadar environment with the Active Directory environment.

  C. Run the command "ntpdate -q " and see if the offset between the QRadar machine and the Active Directory machine is larger than 300 seconds.

  D. Run the command "/opt/qradar/bin/support/Check_AD.sh " and see if the output of the script displays the source of the authentication problems.

  Correct Answer: B

• Question 38:

  Which query, when run from IBM Security QRadar SIEM V7.2.8, will show EPS for log sources?

  A. select logsourcename(logsourceid) as LogSource, sum(eventcount) / ((max(endTime) - min (startTime)) / 1000) as EPS from events group by logsourceid order by EPS desc last 24 hours

  B. select logsourcename(logsourceqid) as LogSource, sum(eventcount) / ((max(endTime) - min (startTime)) / 1000) as EPS from events group by logsourceqid order by EPS desc last 24 hours

  C. select logsourcename(logsourceid) as LogSource, sum(eventcount) / ((max(endTime) - min (startTime)) / 1000) as FPS from events group by logsourceid order by EPS desc last 24 hours

  D. select logsourcename(logsourceid) as LogSource, sum(eventcount) / ((max(endTime) - min (startTime)) / 1000) as EPS from events group by logsourceid order by FPS desc last 24 hours

  Correct Answer: B

• Question 39:

  Which appliance can run IBM Security QRadar SIEM V7.2.8 and includes a single QFlow Collector component?

  A. QRadar 2100

  B. QRadar 3105

  C. QRadar 3124

  D. QRadar 3128

  Correct Answer: D

• Question 40:

  What is the minimum required IBM Security QRadar SIEM software level to upgrade directly to V7.2.8?

  A. QRadar 7.2.3

  B. QRadar 7.2.4

  C. QRadar 7.2.6

  D. QRadar 7.2.7 Patch1

  Correct Answer: B