IBM IBM Certifications C2150-624 Questions & Answers

• Question 81:

  What is the maximum number of dashboards a user can create with IBM Security QRadar SIEM V7.2.8?

  A. 10

  B. 25

  C. 100

  D. 255

  Correct Answer: D

  Create custom dashboards that are relevant to your responsibilities. 255 dashboards per user is the maximum; however, performance issues might occur if you create more than 10 dashboards.

• Question 82:

  What is the Events Per Second (EPS) basic license limit in an IBM Security QRadar V7.2.8 2100 hardware appliance?

  A. 200

  B. 1000

  C. 2500

  D. 10000

  Correct Answer: C

• Question 83:

  Where are the logs for QFlow stored on IBM Security QRadar SIEM V7.2.8?

  A. /var/log/qflow.debug

  B. /opt/var/log/qflow.debug

  C. /opt/log/qradar/qflow.debug

  D. /opt/qradar/log/qflow.debug

  Correct Answer: A

  You can review the log files for the current session individually or you can collect them to review later.

  Follow these steps to review the QRadar log files.

  To help you troubleshoot errors or exceptions, review the following log files.

  /var/log/qradar.log

  /var/log/qradar.error

  If you require more information, review the following log files:

  /var/log/qradar-sql.log

  /opt/tomcat6/logs/catalina.out

  /var/log/qflow.debug

  Review all logs by selecting Admin > System and License Mgmt> Actions > Collect Log Files.

• Question 84:

  What data is purged by the SIM reset process "Hard Clean" in IBM Security QRadar SIEM V7.2.8?

  A. All current and historical SIM data.

  B. All historical SIM data, current SIM data is retained.

  C. All SIEM data, a complete reconfiguration is required.

  D. All source and destination IP addresses are purged, all offenses in the database are closed.

  Correct Answer: A

  Hard clean Purges all current and historical SIM data, which includes offenses, source IP addresses, and destination IP addresses.

• Question 85:

  An Administrator working with a customer looking to add IBM Security QRadar SIEM V7.2.8 into their

  network, has some requirements. The customer is looking to have 40Tb of raw storage space for events

  and console data.

  What appliances allow for this requirement to be met?

  A. QRadar 3128 Console + QRadar 1410 Data Node

  B. QRadar 3128 Console + QRadar 1400 Data Node

  C. QRadar 3118 Console + QRadar 1410 Data Node

  D. QRadar 3128 Console + QRadar Flow Processor 1728

  Correct Answer: B

  The IBM Security QRadar 1400 Data Node (MTM 4380-Q1E) appliance provides scalable data storage solution for QRadar deployments. The QRadar 1400 Data Node enhances data retention capabilities of a deployment as well as augment overall query performance

• Question 86:

  An IBM Security QRadar SIEM V7.2.8 Administrator wants to create a security profile within the system but

  receives an error upon saving.

  What is a possible reason for this error?

  A. The Administrator has used non alpha numeric value(s) in the name which is not allowed.

  B. The Administrator has used less than 3 characters or more than 30 characters as name of the security profile.

  C. The Administrator has mixed non alpha numeric value(s) and alpha numeric value(s) in the name which is not allowed.

  D. The Administrator must bring the IBM Security QRadar SIEM V7.2.8 system first in edit mode before changes are allowed.

  Correct Answer: B

  In the Security Profile Name field, type a unique name for the security profile. The security profile name must meet the following requirements: minimum of 3 characters and maximum of 30 characters.

• Question 87:

  An Administrator working with IBM Security QRadar SIEM V7.2.8 has updated the date/time on the

  QRadar console system and wants to update these date/time settings to all his hosts in the distributed

  environment.

  What command should be run?

  A. /opt/qradar/bin/datesync_all_servers.sh

  B. /opt/qradar/support/all_servers.sh /opt/qradar/bin/time_sync.sh

  C. /opt/qradar/support/fullDeployment.sh /opt/qradar/bin/time_sync.sh

  D. /opt/qradar/support/all_servers.sh /opt/qradar/bin/check_date_change.sh

  Correct Answer: B

  To run time synchronization on all hosts and see if any fail to synchronize with the Console, from the root directory (/) type the following command: ./opt/qradar/support/all_servers.sh "/opt/qradar/bin/time_sync.sh"

• Question 88:

  An IBM Security QRadar SIEM V7.2.8 Administrator is receiving an I/O error on the console. Which command can the Administrator run to begin diagnosing this issue?

  A. /etc/init.d/tomcat status

  B. /etc/init.d/ariel_query_server status

  C. /opt/qradar/init/apply_tunning status

  D. /opt/qradar/init/ariel_query_server status

  Correct Answer: D

  If the Ariel Query Server is not running, a full configuration deployment may resolve this issue by restarting all services on the managed host after deploying the most recent configuration on it. If the Ariel Query Server is still not running after a full deployment, contact support for further assistance.

• Question 89:

  How many dashboards come by default in IBM Security QRadar SIEM V7.2.8?

  A. 1

  B. 5

  C. 7

  D. 10

  Correct Answer: B

  There are five default dashboards: 1 application overview 2 compliance overview 3 network overview 4 system monitoring 5 threat and security monitoring

• Question 90:

  An Administrator working with IBM Security QRadar SIEM V7.2.8 needs to copy data and configuration

  backup files from the previous day to an off-site location.

  What is the default location where these files can be found?

  A. /store/backup

  B. /store/exports

  C. /store/postgres

  D. /store/backupHost

  Correct Answer: A

  The default location is /store/backup. This path must exist before the backup process is initiated. If this path does not exist, the backup process aborts. If you modify this path, make sure the new path is valid on every system in your deployment.