Free C2150-624 Exam Dumps PDF Preview

Question 1

Single choice

The following error message is displayed when an Administrator attempts to log in to the IBM Security QRadar SIEM V7.2.8 environment with a known valid Active Directory (AD)account: "The username and password you supplied are not valid. Please try again."

What procedure should be followed to find the problem?

A
Run the command "adconn -q <AD IP Address>" and see if the machine can connect to the AD
Servers.
B
Run the command "setaddate -q <AD IP Address>" to synchronize the system time of the QRadar
environment with the Active Directory environment.
C
Run the command "ntpdate -q <AD IP Address>" and see if the offset between the QRadar machine
and the Active Directory machine is larger than 300 seconds.
D
Run the command "/opt/qradar/bin/support/Check_AD.sh <AD IP Address>" and see if the output of
the script displays the source of the authentication problems.

Reveal answer details Close answer details

Correct answerB

Question 2

Single choice

An Administrator working with IBM Security QRadar SIEM V7.2.8 needs to delete a single value named User1 from a reference set with the name "Allowed Users" from the command line interface.

Which command will accomplish this?

A
./UtilReferenceSet.sh purge "Allowed Users" User1
B
./ReferenceSetUtil.sh purge "Allowed Users" User1
C
./ReferenceSetUtil.sh delete "Allowed\ Users" User1
D
./UtilReferenceSet.sh delete "Allowed\ Users" User1

Reveal answer details Close answer details

Correct answerB

Explanation

The Referencesetutil.sh purge is the correct syntax of the command. It deletes the specific user when you mention it within the reference set.

Question 3

Single choice

Given the following RegEx:
(\b\d{1,3}\.\d{1,3}\.\d{1,3}\.

\d{1,3}\b) What data does this expression extract?

A
URL
B
User Name
C
IP address
D
Email Address

Reveal answer details Close answer details

Correct answerC

Question 4

Single choice

An IBM Security QRadar SIEM V7.2.8 Administrator needs to download a nightly configuration backup file from a past day through the Web Console.

Which steps must be followed to achieve this?

A
Admin Tab -> System Configuration -> Backup and Recovery -> Generate new backup -> Save
B
Admin Tab -> System Configuration -> Backup and Recovery ->Choose the name of an Existing
backup
C
Admin Tab -> System Configuration -> Backup and Recovery -> Import New Backup -> Select file
extension -> Save
D
Admin Tab -> System Configuration -> System Settings -> Database Settings -> Choose the name of
an Existing backup

Reveal answer details Close answer details

Correct answerB

Explanation

The backups are listed in Backup and recovery section of the system configuration in the admin tab.
You can click on the existing backup and it will show you the options to download it.

Question 5

Single choice

An Administrator working with IBM Security QRadar SIEM V7.2.8 is constantly receiving the following message: "MPC: Unable to process offense. The maximum number of offenses has been reached."

What is the reason for this message?

A
The Multi Packet Capturer cannot handle more than 2500 attacks at the same time.
B
The Magistrate Processor Core has more than 2500 active Offenses or 100000 overall Offenses.
C
The Multi Packet Capturer cannot handle more than 500 offense reports at a certain point in time.
D
The Magistrate Processor Core has reached its maximum amount of network connections at a certain time.

Reveal answer details Close answer details

Correct answerB

Question 6

Single choice

An IBM Security QRadar SIEM V7.2.8 Administrator wants to create a security profile within the system but receives an error upon saving.

What is a possible reason for this error?

A
The Administrator has used non alpha numeric value(s) in the name which is not allowed.
B
The Administrator has used less than 3 characters or more than 30 characters as name of the security profile.
C
The Administrator has mixed non alpha numeric value(s) and alpha numeric value(s) in the name which is not allowed.
D
The Administrator must bring the IBM Security QRadar SIEM V7.2.8 system first in edit mode before changes are allowed.

Reveal answer details Close answer details

Correct answerB

Explanation

In the Security Profile Name field, type a unique name for the security profile. The security profile name must meet the following requirements: minimum of 3 characters and maximum of 30 characters.

Question 7

Single choice

An IBM Security QRadar SIEM V7.2.8 Administrator has been retaining event data for compliance purposes. Data is no longer necessary and the administrator needs to delete a specific retention bucket.

Where does the Administrator do this configuration?

A
Administrator needs to reset the SIM and purge the file system
B
Admin tab -> Data Sources -> Flow retention icon -> Select the flow retention bucket -> Delete
C
Admin tab -> Data Sources -> Event retention icon -> Select the event retention bucket -> Delete
D
Admin tab -> Data Sources -> Event or Flow retention -> Double-click the first empty row in the table ->
Delete

Reveal answer details Close answer details

Correct answerD

Question 8

Single choice

What must be done when creating a user with a non-admin role on an IBM Security QRadar SIEM V7.2.8 system that is utilizing Active Directory authentication?

A
Ensure the password has a minimum of 8 characters.
B
Create the user's initial password and have them change it immediately.
C
Ensure the user's QRadar password matches their Active Directory password.
D
A password does not need to be set on QRadar when using Active Directory authentication.

Reveal answer details Close answer details

Correct answerC

Question 9

Single choice

Where are the logs for QFlow stored on IBM Security QRadar SIEM V7.2.8?

A
/var/log/qflow.debug
B
/opt/var/log/qflow.debug
C
/opt/log/qradar/qflow.debug
D
/opt/qradar/log/qflow.debug

Reveal answer details Close answer details

Correct answerA

Explanation

You can review the log files for the current session individually or you can collect them to review later.
Follow these steps to review the QRadar log files.
To help you troubleshoot errors or exceptions, review the following log files.
/var/log/qradar.log
/var/log/qradar.error

If you require more information, review the following log files:
/var/log/qradar-sql.log
/opt/tomcat6/logs/catalina.out
/var/log/qflow.debug
Review all logs by selecting Admin > System & License Mgmt> Actions > Collect Log Files.

Question 10

Single choice

How would an Administrator working with IBM Security QRadar SIEM V7.2.8 review all logs?

A
Admin Tab -> System Configuration -> Actions -> Collect Log Files
B
Admin Tab -> System Configuration -> Actions -> Collect All Log Files
C
Admin Tab -> System & License Management -> Actions -> Collect Log Files
D
Admin Tab -> System & License Management -> Actions -> Collect All Log Files

Reveal answer details Close answer details

Correct answerB

Question 11

Single choice

What is the minimum required IBM Security QRadar SIEM software level to upgrade directly to V7.2.8?

A
QRadar 7.2.3
B
QRadar 7.2.4
C
QRadar 7.2.6
D
QRadar 7.2.7 Patch1

Reveal answer details Close answer details

Correct answerB

Question 12

Single choice

An Administrator working with IBM Security QRadar SIEM V7.2.8 has updated the date/time on the QRadar console system and wants to update these date/time settings to all his hosts in the distributed environment.

What command should be run?

A
/opt/qradar/bin/datesync_all_servers.sh
B
/opt/qradar/support/all_servers.sh /opt/qradar/bin/time_sync.sh
C
/opt/qradar/support/fullDeployment.sh /opt/qradar/bin/time_sync.sh
D
/opt/qradar/support/all_servers.sh /opt/qradar/bin/check_date_change.sh

Reveal answer details Close answer details

Correct answerB

Explanation

To run time synchronization on all hosts and see if any fail to synchronize with the Console, from the root directory (/) type the following command: ./opt/qradar/support/all_servers.sh "/opt/qradar/bin/time_sync.sh"

Question 13

Single choice

An Administrator working with IBM Security QRadar SIEM V7.2.8 needs to enable the PCI report template.

What is the procedure to accomplish this task?

A
Admin Tab -> Reports -> Templates -> Compliance -> PCI -> Select "Enable"
B
Report Tab -> Enable "Show all templates" -> Group List -> Compliance -> PCI
C
Reports Tab -> Clear "Hide Inactive Reports" box -> Group List -> Compliance -> PCI
D
Admin Tab -> Reports -> Templates -> Compliance -> PCI -> uncheck "Hide Template"

Reveal answer details Close answer details

Correct answerC

Explanation

1. Click the Reports tab.
2. Clear the Hide Inactive Reports check box.
3. In the Group list, select Compliance > PCI.
4. Select all report templates on the list:
a. Click the first report on the list. b. Select all report templates by holding down the Shift key, while you click the last report on the list.
5. In the Actions list, select Toggle Scheduling.
6. Access generated reports:
a. From the list in the Generated Reports column, select the time stamp of the report that you want to view. b. In the Format column, click the icon for report format that you want to view.

Question 14

Single choice

Which AQL query, when run from IBM Security QRadar SIEM V7.2.8, will show EPS broken down by domains?

A
select DOMAINNAME (domainid) as LogSource, sum(eventcount) / ((max(endTime) ? min(startTime)) / 1000 ) as EPS from events group by domainid order by EPS desc last 24 hours
B
select DOMAINNAME (domainqid) as LogSource, sum(eventcount) / ((max(endTime) ? min(startTime))
/ 1000 ) as EPS from events group by domainqid order by FPM desc last 24 hours
C
select DOMAINNAME (domainid) as LogSource, sum(events) / ((max(endTime) ?min(startTime)) / 1000 ) as EPS from events group by domainid order by FPM desc last 24 hours
D
select DOMAINNAME (domainid) as LogSource, sum(events) / ((max(endTime) ?min(startTime)) / 1000 ) as EPS from events group by domainid order by EPS desc last 24 hours

Reveal answer details Close answer details

Correct answerA

Explanation

You would use single-quotes to define this search string. I believe I had an example in the presentation yesterday I need to fix where I accidently used double-qoutes, which is incorrect.
The AQL search below uses quotes correctly: select logsourcename(logsourceid) as LogSource, sum(eventcount) / ( ( max(endTime) -min(startTime) ) / 1000 ) as EPS from events WHERE logsourcename(logsourceid) = 'Windows Auth@ 10.10.10.10' group by logsourceid order by EPS desc last 5 MINUTES
Or to snag multiple log sources, for example Windows events, you could use the following: select logsourcename(logsourceid) as LogSource, sum(eventcount) / ( ( max(endTime) -min(startTime) ) / 1000 ) as EPS from events WHERE logsourcename(logsourceid) is ILIKE '%Windows%' group by logsourceid order by EPS desc last 5 MINUTES

Question 15

Single choice

An Administrator of an IBM Security QRadar SIEM V7.2.8 deployment has configured an asset data source with domain information. This has created several new asset profiles.

What would explain these new asset profiles?

A
The asset data source parameter "Collateral Damage Potential" was left at the default "Not Defined"
B
The data in the asset model is domain-aware, this information is applied to all QRadar components, including server discovery.
C
The data in the asset model is used to compare flow data and identify other assets. These assets are added to a "Whitelist" database for asset reconciliation.
D
The asset data source is attempting to process an asset merge. The information from one asset is combined with the information for another asset under the premise that they are actually the same physical asset.

Reveal answer details Close answer details

Correct answerA

Question 16

Single choice

An IBM Security QRadar SIEM V7.2.8 Administrator is given a file to import asset information directly to the asset database.

What should the Administrator be aware of when using this data source?

A
The asset data being imported must contain one field no longer than 255 characters in length.
B
The asset data imported will have a default retention period of 120 days until flow data is received from the asset.
C
The asset reconciliation stage is bypassed and asset updates that are provided by users do not
introduce asset growth deviations.
D
The asset data from users are paired with an asset based on a single identifier, the IP address and flow data is never the cause of asset growth deviations.

Reveal answer details Close answer details

Correct answerC

Free C2150-624 Exam Dumps Preview

IBM Security QRadar Risk Manager V7.2.6 Administration

PREVIEW CONTENTS · 1 VOLUME

QUESTION 1

QUESTION 2

QUESTION 3

QUESTION 4

QUESTION 5

QUESTION 6

QUESTION 7

QUESTION 8

QUESTION 9

QUESTION 10

QUESTION 11

QUESTION 12

QUESTION 13

QUESTION 14

QUESTION 15

QUESTION 16