IBM C2150-400 Online Practice Questions and Exam Preparation

IBM C2150-400 Online Questions & Answers

• Question 1:

  A customer is observing the Asset tab on the QRadar console and is getting duplicate assets in the console. What is the reason for this asset duplication?

  A. There are multiple heterogeneous assets present in environment.
  B. There are multiple assets having same configuration details present in environment.
  C. QRadar creates duplicate assets after a specific periodic interval without considering asset activity or inactivity.
  D. Asset doesn't appear in network for specific time period; when it came back QRadar detects it and created a new asset for the same.
  C. QRadar creates duplicate assets after a specific periodic interval without considering asset activity or inactivity.

• Question 2:

  A customer has configured NetApp storage device to send events to QRadar SIEM. The customer wants an alert to be generated whenever error messages (Improper power supply in the shelf for NetApp device) appear on the console. How can a QRadar administrator generate the alert whenever error message appear on the QRadar console?

  A. Offenses > Rules > Actions > New Event Rule
  B. Offenses > Rules > Click on Rule Wizard Button
  C. Admin Tab > Rule Management > New Event Rule
  D. Admin Tab > Rule Management > Actions > New Event Rule
  A. Offenses > Rules > Actions > New Event Rule

• Question 3:

  A QRadar administrator is developing custom uDSM's for an unsupported device.

  Given this event payload:

  <13> Jan 28 12:57:23 9.77.16.19 AgentDevice=FileForwarder AgentLogFile=logger1.log Payload=January 28,2014 12:53:50 PM GMT+05:30|HOST_CREATE_ERROR|Host{1:testserver40} create failed on array {0:Abc}

  Which regular expression should the administrator define for parsing the hostname "testserfvefr40"?

  A. \w+\s+{.*?\\s}
  B. \w+\s+{\d+\:(\.*?)\}
  C. \w+\s+{\d+\:(\w+)\}
  D. \w+\s+{\d+\:([a-zA-Z]+)\}
  D. \w+\s+{\d+\:([a-zA-Z]+)\}

  ---

  explanation:

  Reference: http://stackoverflow.com/questions/1653425/a-za-z-a-za-z0-9-regular-expression

• Question 4:

  Which icon on the Admin tab do you select when setting up QRadar to use an external authentication method?

  A. Users
  B. Authentication
  C. System Settings
  D. Authorized Services
  C. System Settings

• Question 5:

  Which statement is correct for patching an HAed server?

  A. If the Secondary host is in an Active state, the patch should be applied to the Secondary.
  B. The patch should be applied to the Primary first and the patch should be applied to the Secondary.
  C. Remove Secondary, then apply the patch on Primary, and then add the Secondary again.
  D. Run the patch on the Primary and the Secondary will be updated Automatically.
  B. The patch should be applied to the Primary first and the patch should be applied to the Secondary.

• Question 6:

  In QRadar SIEM, customer wants to tune one of the firewall deny event which shows firewall deny for all events coming from a Syslog Server and has been identified as false positive. The customer clicked on the "false positive" button to tune the specific event.

  What are the traffic directions that will be available during declaring this event as a false positive? (Choose two.)

  A. SourceIP to Local Network
  B. SourceIP to Any Destination
  C. Any source to Any Destination
  D. Destination IP to Local Network
  E. Source IP to Destination Network
  B. SourceIP to Any Destination
  E. Source IP to Destination Network

  ---

  explanation:

  Reference: e ftp://public.dhe.ibm.com/software/security/products/qradar/documents/71MR1/SIEM/ CoreDocs/QRadar_71MR1_TuningGuide.pdf (page 25)

• Question 7:

  Which action can be performed on a license key?

  A. Erase a license key
  B. Delete a license key
  C. Unload a license key
  D. Unallocate a license key
  B. Delete a license key

• Question 8:

  Which statement is true with regard to auto discovery functionality?

  A. All supported DSMs are auto discovered.
  B. Only 50 Log Sources can be auto discovered.
  C. Auto discovered log sources are assigned to a generic log source group.
  D. QRadar license key defines the maximum number of log sources that can be auto discovered.
  C. Auto discovered log sources are assigned to a generic log source group.

  ---

  explanation:

  Reference: http://www.ibm.com/support/knowledgecenter/SS42VS_7.2.1/com.ibm.qradar.doc_7.2.1/ c_logsource_groups.html

• Question 9:

  Which two fields are required to be filled out when adding a new network to the network hierarchy? (Choose two.)

  A. Group
  B. Country
  C. Mail Server
  D. DNS Server
  E. IP and CIDR
  D. DNS Server
  E. IP and CIDR

• Question 10:

  Which file needs to be installed to patch to QRadar release 7.2.1.xxx?

  A. 721_QRadar_patchupdate-7.2.1.xxx.iso
  B. 721_QRadar_patchupdate-7.2.1.xxx.sfs
  C. 721_QRadar_patchupdate-7.2.1.xxx.md5
  D. 721_QRadar_patchupdate-7.2.1.xxx.patch
  D. 721_QRadar_patchupdate-7.2.1.xxx.patch