VCEdump

C2150-612 IBM Security QRadar SIEM V7.2.6 Associate Analyst

PDF question preview Back to product

Reading controls

Reader tools

Free demo

16 of 105 questions

Purchase the full version to unlock every question and answer.

View the full question set

Preview tools

Try Web TestEngine

Question formats

Single choice12

Multiple choice4

IBM · C2150-612

Free C2150-612 Exam Dumps Preview

Preview real exam questions, verified answers and available explanations before choosing a study plan.

Question 1

Single choice

Given these default options for dashboards on the QRadar Dashboard Tab:

Which will display a list of offenses?

A
Network Overview
B
System Monitoring
C
Vulnerability Management
D
Threat and Security Monitoring

Reveal answer details Close answer details

Correct answerD

Question 2

Single choice

What is the correct procedure for closing an offense?

A
From the Offenses Tab, select the offense(s), click on Actions, select Close
B
From the Dashboard, select the offense(s) in question, right click and select Close
C
From the Offense Summary Page, click Display and select Close and select the reason
D
From the Offenses Tab, select the offense(s), right click on selection, select Close

Reveal answer details Close answer details

Correct answerA

Explanation

References:
https://www.ibm.com/support/knowledgecenter/en/SS42VS_7.3.1/com.ibm.qradar.doc/
t_qradar_closing_offenses.html

Question 3

Single choice

What is the purpose of coalescing?

A
To reduce the number of events which count against EPS licenses
B
To reduce the amount of data received by QRadar event collectors
C
To reduce the amount of data going through the pipeline and stored onto disk
D
To reduce the number of offenses generated by QRadar as part of the tuning process

Reveal answer details Close answer details

Correct answerA

Explanation

References:
https://developer.ibm.com/answers/questions/438469/out-eps-licence-is-10k-im-attaching-two-screenshot/

Question 4

Multiple choice

What are two common uses for a SIEM? (Choose two.)

A
Managing and normalizing log source data
B
Identifying viruses based on payload MD5s
C
Blocking network traffic based on rules matched
D
Enforcing governmental compliance auditing and remediation
E
Performing near real-time analysis and observation of a network and its devices

Reveal answer details Close answer details

Correct answersA, B

Question 5

Single choice

How does a Device Support Module (DSM) function?

A
A DSM is a configuration file that combines received events from multiple log sources and displays them as offenses in QRadar.
B
A DSM is a background service running on the QRadar appliance that reaches out to devices deployed in a network for configuration data.
C
A DSM is a configuration file that parses received events from multiple log sources and converts them to a standard taxonomy format that can be displayed as outputs.
D
A DSM is an installed appliance that parses received events from multiple log sources and converts them to a standard taxonomy format that can be displayed as outputs.

Reveal answer details Close answer details

Correct answerC

Explanation

References:
ftp://public.dhe.ibm.com/software/security/products/qradar/documents/7.3.0/en/
b_qradar_tuning_guide.pdf (32)

Question 6

Single choice

Which saved searches can be included on the Dashboard?

A
Event and Flow saved searches
B
Asset and Network saved searches
C
User and Vulnerability saved searches
D
Network Activity and Risk saved searches

Reveal answer details Close answer details

Correct answerA

Question 7

Single choice

A Security Analyst, looking at a Log Activity search result, wants to limit the results to one Log Source.

Which right-click method would be the fastest way for the Security Analyst to ensure this?

A
Right click on a Log Source name, then select Filter on Log Source is <log source>
B
Right click on a Source IP Address, then select Filter on Log Source is <log source>
C
Right click on the Log Source Type name, then select Filter on Log Source Group is <log source
group>
D
Right click on the Log Source Group name, then select Filter on Log Source Group is <log source
group>

Reveal answer details Close answer details

Correct answerA

Question 8

Single choice

What is the maximum number of supported dashboards for a single user?

A
10
B
25
C
255
D
1023

Reveal answer details Close answer details

Correct answerC

Explanation

References:
http://www.ibm.com/support/knowledgecenter/SS42VS_7.2.7/com.ibm.qradar.doc/
c_qradar_custom_dboard.html

Question 9

Single choice

What is the primary goal of data categorization and normalization in QRadar?

A
It allows data from different kinds of devices to be compared.
B
It preserves original data allowing for forensic investigations.
C
It allows for users to export data and import it into other system.
D
It allows for full-text indexing of data to improve search performance.

Reveal answer details Close answer details

Correct answerA

Question 10

Single choice

What is the effect of toggling the Global/Local option to Global in a Custom Rule?

A
It allows a rule to compare events & flows in real time.
B
It allows a rule to analyze the geographic location of the event source.
C
It allows rules to be tracked by the central processor for detection by any Event Processor.
D
It allows a rule to inject new events back into the pipeline to affect and update other incoming events.

Reveal answer details Close answer details

Correct answerC

Question 11

Single choice

While on the Offense Summary page, a specific Category of Events associated with the Offense can be

investigated.

Where should a Security Analyst click to view them?

A
Click on Events, then filter on Flows
B
Highlight the Category and click the Events icon
C
Scroll down to Categories and view Top 10 Source IPs
D
Right Click on Categories and choose Filter on Network Activity

Reveal answer details Close answer details

Correct answerB

Explanation

References:
IBM Security QRadar SIEM Users Guide. Page: 42

Question 12

Multiple choice

What are two default Report Groups? (Choose two.)

A
Analyst
B
Executive
C
Administration
D
Log Management
E
Network Management

Reveal answer details Close answer details

Correct answersB, E

Explanation

References:
https://www.ibm.com/support/knowledgecenter/en/SS42VS_7.3.1/com.ibm.qradar.doc/
c_qradar_rpt_grps.html

Question 13

Single choice

Which flow fields should be used to determine how long a session has been active on a network?

A
Start time and end time
B
Start time and storage time
C
Start time and last packet time
D
Last packet time and storage time

Reveal answer details Close answer details

Correct answerC

Explanation

Flow timestamps are created as traffic are detected and recored by the QRadar Flow Collector. Some flows can last seconds, ie, an email message, file upload, etc, while others may far longer - minutes, hours, or even days, such as an interactive remote session, audio/video stream (Netflix, voip call), or database <>
application connection. As these sessions/flows continue over time, they are reported into the system. The original "start time" for each session remains the same, when first detected, while the "last packet time" will update as time passes. The best way to see this is to search for the two ip addresses involved in the session/flow, then search over a longer time window ?you should see multiple records, one that ends for each minute that the session was active. Each minute will also have the byte & packet count, for each minute the flow was active.
References:
https://developer.ibm.com/qradar/2018/01/09/qradar-flow-faq/

Question 14

Single choice

Which set of information is provided on the asset profile page on the assets tab in addition to ID?

A
Asset Name, MAC Address, Magnitude, Last user
B
IP Address, Asset Name, Vulnerabilities, Services
C
IP Address, Operating System, MAC Address, Services
D
Vulnerabilities, Operative System, Asset Name, Magnitude

Reveal answer details Close answer details

Correct answerC

Explanation

References:
https://www.ibm.com/support/knowledgecenter/SS42VS_7.2.1/com.ibm.qradar.doc_7.2.1/
c_qradar_ug_asset_sum.html

Question 15

Multiple choice

What are the two available formats for exporting event and flow data for external analysis? (Choose two.)

A
XML
B
DOC
C
PDF
D
CSV
E
HTML

Reveal answer details Close answer details

Correct answersA, D

Question 16

Multiple choice

Which two pieces of information can be found under the Log Activity tab? (Choose two.)

A
Offenses
B
Vulnerabilities
C
Firewall events
D
Destination Bytes
E
Internal QRadar messages

Reveal answer details Close answer details

Correct answersA, D

Free C2150-612 Exam Dumps Preview

IBM Security QRadar SIEM V7.2.6 Associate Analyst

PREVIEW CONTENTS · 2 VOLUMES

QUESTION 1

QUESTION 2

QUESTION 3

QUESTION 4

QUESTION 5

QUESTION 6

QUESTION 7

QUESTION 8

QUESTION 9

QUESTION 10

QUESTION 11

QUESTION 12

QUESTION 13

QUESTION 14

QUESTION 15

QUESTION 16

VOL	TYPE	QUESTIONS
1	Single choice	12
2	Multiple choice	4