IBM IBM Certifications C2150-624 Questions & Answers

• Question 61:

  During the IBM Security QRadar SIEM V7.2.8 installation, which two default user roles are defined? (Choose two.)

  A. All

  B. Any

  C. Admin

  D. SuperUser

  E. SuperAdmin

  Correct Answer: AC

  Two default user roles are listed in the left pane of the window: Admin and All. You can select a role in the left pane to view the associated role permissions in the right pane.

• Question 62:

  Which appliance of the IBM Security QRadar SIEM V7.2.8 family is a specifically used to gather events from local and remote log sources?

  A. QRadar Event Console

  B. QRadarQFlow Collector

  C. QRadar Event Collector D. QRadar Event Processor

  Correct Answer: C

  Gathers events from local and remote log sources.Normalizes raw log source events. During this process, the Magistrate component examines the event from the log source and maps the event to a QRadar Identifier (QID). Then, the Event Collector bundles identical events to conserve system usage and sends the information to the Event Processor.

• Question 63:

  An Administrator has configured a customized log source extension to provide asset updates to IBM Security QRadar SIEM V7.2.8. Instead of QRadar receiving an update that has the host name of the asset that the user logged in to, the log source generates many asset updates that all have the same host name. In this situation what will QRadar report?

  A. This will cause stale asset data.

  B. This will cause asset growth deviations.

  C. This will cause excessive authentication failure events.

  D. This will cause excessive flow data to be processed by the Magistrate.

  Correct Answer: B

  Instead of QRadar receiving an update that has the host name of the asset that the user logged in to, the

  log source generates many asset updates that all have the same host name.

  In this situation, the asset growth deviation is caused by one asset profile that contains many IP addresses

  and user names.

• Question 64:

  The event pipeline for processing event data before viewing and using event data on the IBM Security QRadar SIEM V7.2.8 console consists of many components, what is one component?

  A. Indexing Component

  B. Flow Data Component

  C. Magistrate Component

  D. Event Data Component

  Correct Answer: C

• Question 65:

  An IBM Security QRadar SIEM V7.2.8 Administrator notices a specific MAC address added to the Asset

  Reconciliation Domain MAC was blacklisted.

  What scenario is causing this to occur?

  A. When a MAC address is associated to three or more different IP addresses in 2 hours or less.

  B. When an IPv4 address is associated to three or more different MAC addresses in 2 hours or less.

  C. When a MAC address is associated to three or more different IP addresses in 10 minutes or less.

  D. When an IPv4 address is associated to three or more different MAC addresses in 10 minutes or less.

  Correct Answer: A

• Question 66:

  Which AQL query, when run from IBM Security QRadar SIEM V7.2.8, will show EPS broken down by domains?

  A. select DOMAINNAME (domainid) as LogSource, sum(eventcount) / ((max(endTime) ? min(startTime)) / 1000 ) as EPS from events group by domainid order by EPS desc last 24 hours

  B. select DOMAINNAME (domainqid) as LogSource, sum(eventcount) / ((max(endTime) ? min(startTime)) / 1000 ) as EPS from events group by domainqid order by FPM desc last 24 hours

  C. select DOMAINNAME (domainid) as LogSource, sum(events) / ((max(endTime) ?min(startTime)) / 1000 ) as EPS from events group by domainid order by FPM desc last 24 hours

  D. select DOMAINNAME (domainid) as LogSource, sum(events) / ((max(endTime) ?min(startTime)) / 1000 ) as EPS from events group by domainid order by EPS desc last 24 hours

  Correct Answer: A

  You would use single-quotes to define this search string. I believe I had an example in the presentation

  yesterday I need to fix where I accidently used double-qoutes, which is incorrect.

  The AQL search below uses quotes correctly:

  select logsourcename(logsourceid) as LogSource, sum(eventcount) / ( ( max(endTime) -min(startTime) ) /

  1000 ) as EPS from events WHERE logsourcename(logsourceid) = 'Windows Auth@ 10.10.10.10' group

  by logsourceid order by EPS desc last 5 MINUTES

  Or to snag multiple log sources, for example Windows events, you could use the following:

  select logsourcename(logsourceid) as LogSource, sum(eventcount) / ( ( max(endTime) -min(startTime) ) /

  1000 ) as EPS from events WHERE logsourcename(logsourceid) is ILIKE '%Windows%' group by

  logsourceid order by EPS desc last 5 MINUTES

• Question 67:

  An Administrator needs to see Events per Second (EPS) and Flows per Minute (FPM) coming to IBM Security QRadar SIEM V7.2.8 through a dashboard. How could this be accomplished?

  A. Download the dashboard from IBM Security App Exchange.

  B. Go to CLI and run the script /opt/qradar/bin/createdashboard.sh

  C. Select any dashboard and customize it. Add a system summary item.

  D. Create a new dashboard and then go to admin tab. Add item into the dashboard created.

  Correct Answer: D

  To determine the average EPS rate, users can click the Dashboard tab, then select the System Monitoring dashboard item. This dashboard contains and event per second and flows per minute dashboard item. To see EPS details, click the View in Log Activity link. This will give an estimate of the data size for events per day.

• Question 68:

  An Administrator working with IBM Security QRadar SIEM V7.2.8 is constantly receiving the following

  message:

  "SAR Sentinal: Threshold crossed."

  Where will the Administrator tune the settings for these messages?

  A. Admin tab -> General Settings -> Global System Notifications

  B. Admin tab -> System Configuration -> Global System Notifications

  C. Admin tab -> System Notifications -> System Activity Reporter Notifications

  D. Admin tab -> System Configuration -> General Settings -> System Notifications

  Correct Answer: B

  The SAR Sentinel utility monitors QRadar for a broad number of functions, such as running processes, CPU usage, and hardware functions. The function of the SAR Sentinel is to monitor the system and provide notifications when the system load exceeds a set threshold.

• Question 69:

  An Administrator working within IBM Security QRadar SIEM V7.2.8 has created a network hierarchy that includes the following groups and subgroups: Office #1 Group

  -Miscellaneous 10.10.0.0/24

  -Sales 10.10.8.0/24

  -Marketing 10.10.1.0/24 Office #2 Group

  -Miscellaneous 10.20.0.0/16

  -Sales 10.20.8.0/24

  -

  Marketing 10.20.1.0/24 A new subgroup is added to Office #1 having a CIDR of 10.10.50.0/24. Offenses are being triggered and during the investigation, it is noticed the rule should not fire if traffic is L2L. The offense is being triggered on traffic from 10.10.4.17 to 10.20.1.8. Is this rule using the network hierarchy correctly?

  A.

  This rule is parsing the network hierarchy correctly, as the 10.10.4.17 address is not contained in a group, and therefore is remote.

  B.

  This rule is parsing the network hierarchy correctly, as the offices are both remotely geo-located, and connecting over the Internet, it is remote traffic.

  C.

  This rule isn't parsing the network hierarchy correctly, as the network hierarchy contains the CIDR for

  10.10.4.17 and 10.20.1.0/24, therefore being L2L traffic.

  D.

  This rule isn't parsing the network hierarchy correctly, as the network hierarchy contains both subnets, but is viewing traffic between groups to be remote instead of local.

  Correct Answer: A

• Question 70:

  An Administrator working within IBM Security QRadar SIEM V7.2.8 has a network hierarchy that cannot support anymore network objects. To remedy this, they want to implement a supernet. Some of the customer CIDRs are:

  -209.60.128.0/24

  -209.60.129.0/24

  -209.60.130.0/24

  -

  209.60.131.0/24

  Which supernet should be used to shrink the amount of network objects for the supplied group of CIDRs?

  A.

  209.60.128.0/22

  B.

  209.60.129.0/23

  C.

  209.60.128.0/23

  D.

  209.60.127.0/27

  Correct Answer: C

  Supernetting, also called Classless Inter-Domain Routing (CIDR), is a way to aggregate multiple Internet addresses of the same class. Using supernetting, the network address 209.60.128.0/24 and an adjacent address 209.60.129.0/24 can be merged into 209.60.128.0/23. The "23" at the end of the address says that the first 23 bits are the network part of the address, leaving the remaining nine bits for specific host addresses