VCEdump

C1000-018 IBM QRadar SIEM V7.3.2 Fundamental Analysis

PDF question preview Back to product

Reading controls

Reader tools

Free demo

9 of 60 questions

Purchase the full version to unlock every question and answer.

View the full question set

Preview tools

Try Web TestEngine

Question formats

Single choice8

Multiple choice1

IBM · C1000-018

Free C1000-018 Exam Dumps Preview

Review sample questions, verified answers and available explanations before choosing a study plan.

Question 1

Single choice

Where can an analyst working with Offenses add a regular expression test into an existing rule?

A
Left
B
Top
C
Bottom
D
Right

Reveal answer details Close answer details

Correct answerB

Question 2

Single choice

An analyst needs to map a geographic location on all the internal IP addresses.

Which option defines the functions where the analyst can-setup a geographic location of the network object in Network Hierarchy?

A
GPS location and Map
B
Group and IP address
C
Log Activity and Network Activity
D
Longitude and Latitude

Reveal answer details Close answer details

Correct answerB

Explanation

References:
https://www.ibm.com/docs/en/qsip/7.4?topic=tasks-network-hierarchy

Question 3

Single choice

An analyst has observed that for a particular user, authentication to an organization's critical server is different than the normal access pattern.

How can the analyst verify that all the authentications initiated from the user are valid?

A
Perform a search with filter Destination IP group by Username, then validate the Username
B
Perform a search with filter Source IP group by Username, then validate the Username
C
Perform a search with filter Username group by Source IP, then validate the Destination IP
D
Perform a search with filter Username group by Source IP, then validate the Source IP

Reveal answer details Close answer details

Correct answerB

Question 4

Single choice

An analyst aims to improve the detection capabilities on all the Offense rules. QRadar SIEM has a tool that allows the analyst to update all the Building Blocks related to Host and Port Definition in a single page.

How is this accomplished?

A
Admin -> Reference Set management
B
Assets -> Asset Profiles
C
Assets -> Server Discovery
D
Admin -> Asset Profile Configuration

Reveal answer details Close answer details

Correct answerC

Question 5

Single choice

An analyst has to perform an export of events within a timeframe, but not all the columns are present in the log view for the time period the analyst has selected. The analyst only needs specific columns exported for an external analysis.

How can the analyst accomplish this task?

A
Edit the search and select the extra columns, then export the result with Action/Export to XML/Full Export. This export is only supported in XML.
B
Edit the search and select the extra columns, then export the result with Action/Export to XML/Visible Columns. This export is only supported in XML.
C
Edit the search result and select the extra columns, then export the result with Action/Export to CSV/
Full Export.
D
Edit the search result and select the extra columns, then export the result with Action/Export to CSV/
Visible Columns.

Reveal answer details Close answer details

Correct answerD

Explanation

References:
https://www.ibm.com/docs/en/qsip/7.4?topic=investigation-exporting-events

Question 6

Single choice

An analyst needs to perform a Quick search to find events under the Log Activity tab that contains an 'exe' file during a certain time period.

How can the analyst do this?

A
On the Search bar select Quick Filter, then insert filter criteria for '/*.exe/' and then select a time interval from the view option's drop down.
B
Select Search - New Search from the menu bar, then select all the search criteria required from the UI options provided.
C
Select Quick Searches on the menu bar, then go through the list of saved searches available to see if one already exists, that can be altered.
D
On the Search bar select Quick Filter, insert: 'exe, last 1 hour' into the filter criteria, then click Search.

Reveal answer details Close answer details

Correct answerA

Explanation

References:
https://www.ibm.com/support/pages/searching-your-qradar-data-efficiently-part-1-quick-filters

Question 7

Single choice

An analyst is investigating an Offense and has found that the issue is that a firewall appears to be misconfigured and has permitted traffic that should be prevented to pass.

As part of the firewall rule change process, the analyst needs to send the offense details to the firewall team to demonstrate that the firewall permitted traffic that should have been blocked.

How would the analyst send the Offense summary to an email mailbox?

A
Find the CRE Event in the Log Activity tab, open the event detail and select 'Email linked Offense details' from the 'Action' menu.
B
Search for the events linked to the Offense in the Log Activity tab; Select all events and copy them
using CTRL-C then paste into an email client.
C
Open the Offense in the Offenses tab, select 'Email' from the 'Action' menu item and, optionally, add some extra information.
D
Identify the Offense in the Offense list, right click on the Offense and select 'Custom Action Script';
'Offense Mailer'

Reveal answer details Close answer details

Correct answerB

Question 8

Multiple choice

When an analyst sees the system notification "The appliance exceeded the EPS or FPM allocation within the last hour", how does the analyst resolve this issue? (Choose two.)

A
Delete the volume of events and flows received in the last hour.
B
Adjust the license pool allocations to increase the EPS and FPM capacity for the appliance.
C
Tune the system to reduce the volume of events and flows that enter the event pipeline.
D
Adjust the resource pool allocations to increase the EPS and FPM capacity for the appliance.
E
Tune the system to reduce the time window from 60 minutes to 30 minutes.

Reveal answer details Close answer details

Correct answersB, C

Explanation

Explanation:
User response
Adjust the license pool allocations to increase the EPS and FPM capacity for the appliance.
Tune the system to reduce the volume of events and flows that enter the event pipeline.

References:
https://www.ibm.com/docs/en/qsip/7.3.2?topic=appliances-maximum-events-flows-reached

Question 9

Single choice

After working with an Offense, an analyst set the Offense as hidden.

What does the analyst need to do to view the Offense at a later time?

A
In the all Offenses view, at the top of the view, select "Show hidden" from the "Select an option" drop-down.
B
Search for all Offenses owned by the analyst.
C
Click Clear Filter next to the "Exclude Hidden Offenses".
D
In the all Offenses view, select Actions, then select show hidden Offenses.

Reveal answer details Close answer details

Correct answerC

Explanation

Explanation:
To clear the filter on the offense list, click Clear Filter next to the Exclude Hidden Offenses search parameter.

References:
https://www.ibm.com/docs/fi/qradar-on-cloud?topic=actions-showing-hidden-offenses

VOL	TYPE	QUESTIONS
1	Single choice	8
2	Multiple choice	1

Free C1000-018 Exam Dumps Preview

IBM QRadar SIEM V7.3.2 Fundamental Analysis

PREVIEW CONTENTS · 2 VOLUMES

QUESTION 1

QUESTION 2

QUESTION 3

QUESTION 4

QUESTION 5

QUESTION 6

QUESTION 7

QUESTION 8

QUESTION 9