IBM C1000-018 Online Practice Questions and Exam Preparation

IBM C1000-018 Online Questions & Answers

• Question 1:

  An analyst for a particular offense needs to investigate to understand the breakdown of the offense details. How can the analyst do this?

  A. Look at the magnitude information and its breakdown.
  B. Look at all the event QIDs attached to the offense.
  C. View the attack path of the offense.
  D. Look at the list of categories, event low level categories and the events attached.
  A. Look at the magnitude information and its breakdown.

• Question 2:

  An analyst is performing an investigation regarding an Offense. The analyst is uncertain to whom some of the external destination IP addresses in List of Events are registered. How can the analyst verify to whom the IP addresses are registered?

  A. Right-click on the destination address, More Options, then Navigate, and then Destination Summary
  B. Right-click on the destination address, More Options, then IP Owner
  C. Right-click on the destination address, More Options, then Information, and then WHOIS Lookup
  D. Right-click on the destination address, More Options, then Information, and then DNS Lookup
  A. Right-click on the destination address, More Options, then Navigate, and then Destination Summary

  ---

  Explanation:

  Navigate > View Destination Summary Displays the offenses that are associated with the selected destination IP address.

  Reference: https://www.ibm.com/docs/en/SS42VS_7.3.3/com.ibm.qradar.doc/b_qradar_users_guide.pdf

• Question 3:

  What is displayed in the status bar of the Log Activity tab when streaming events?

  A. Average number of results that are received per second.
  B. Average number of results that are received per minute.
  C. Accumulated number of results that are received per second.
  D. Accumulated number of results that are received per minute.
  A. Average number of results that are received per second.

  ---

  Explanation:

  Status bar

  When streaming events, the status bar displays the average number of results that are received per second.

  Reference: https://www.ibm.com/docs/en/qradar-on-cloud?topic=investigation-log-activity-tab-overview

• Question 4:

  From which tab in QRadar SIEM can an analyst search vulnerability data and remediate vulnerabilities?

  A. Log Activity
  B. Dashboard
  C. Assets
  D. Admin
  C. Assets

  ---

  Explanation:

  When IBM Security QRadar Vulnerability Manager is enabled, you can perform vulnerability assessment tasks on the Vulnerabilities tab. From the Assets tab, you can run IBM Security QRadar Vulnerability Manager scans on selected assets.

  Reference: http://www.siem.su/docs/ibm/Administration_and_introduction/User_Guide.pdf

• Question 5:

  An analyst had been researching an Offense that has now disappeared from the active Offense list.

  What is the period of time that has to pass before an active Offense that receives no new contributing events or flows become inactive?

  A. 5 days
  B. 3 days
  C. 24 hours
  D. 1 hour
  A. 5 days

  ---

  Explanation:

  An offense remains in a dormant state for 5 days. If an event is added while an offense is dormant, the five-day counter is reset.

  Reference: https://www.ibm.com/docs/en/SS42VS_7.3.2/com.ibm.qradar.doc/b_qradar_users_guide.pdf

• Question 6:

  When an Offense is triggered, it only shows the events that triggered the Offense. The analyst wants to investigate further to see more events around the incident, not only those that triggered the Offense. The analyst clicks on the event count and sees the events belonging to the Offense.

  How can the analyst proceed to see a more detailed picture of what occurred?

  A. Right-click on the source IP, and choose More Options, then Information, and then Search Events.
  B. Right-click on the destination IP, and choose More Options, then Raw Events.
  C. Right-click on the source IP, and choose View in DSM Editor.
  D. Right-click and filter on the Destination IP.
  D. Right-click and filter on the Destination IP.

  ---

  Reference: https://www.ibm.com/docs/en/qradar-on-cloud?topic=events-filtering

• Question 7:

  An analyst observed a port scan attack on an internal network asset from a remote network. Which filter would be useful to determine the compromised host?

  A. Any IP
  B. Destination IP [Indexed]
  C. Source or Destination IP
  D. Source IP [Indexed]
  A. Any IP

• Question 8:

  What is a valid offense naming mechanism? This information should:

  A. set the naming of the associated offense(s).
  B. set or replace the naming of the associated offense(s).
  C. replace the naming of the associated offense(s).
  D. be included in the naming of the associated offense(s).
  A. set the naming of the associated offense(s).

  ---

  Explanation:

  Under "Offense Naming", check "This information should

  contribute to the name of the associated offense(s)".

  Reference: https://www.ibm.com/support/pages/apar/IJ27086

• Question 9:

  What is the maximum time period for 3 subsequent events to be coalesced?

  A. 10 minutes
  B. 10 seconds
  C. 5 minutes
  D. 60 seconds
  B. 10 seconds

  ---

  Explanation:

  Event coalescing starts after three events have been found with matching properties within a 10 second window.

  Reference: https://www.ibm.com/support/pages/qradar-how-does-coalescing-work-qradar

• Question 10:

  An analyst needs to find all events that are creating offenses that are triggered by rules that contain the word suspicious in the rule name. Which query can the analyst use as a working sample?

  A. SELECT LOGSOURCETYPE(logsourceid), “from log_events where RULENAME(creeventlist) ILIKE ‘%suspicious%’
  B. SELECT LOGSOURCERULES(logsourceid), “from rule_events where RULENAME(creeventlist) ILIKE ‘%suspicious%’
  C. SELECT LOGGEDOFFENSE(logsourceid), *from offense_events where RULENAME(creeventlist) ILIKE ‘%suspicious%’
  D. SELECT LOGSOURCENAME(logsourceid), * from events where RULENAME(creeventlist) ILIKE ‘%suspicious%’
  D. SELECT LOGSOURCENAME(logsourceid), * from events where RULENAME(creeventlist) ILIKE ‘%suspicious%’

  ---

  Reference: https://www.ibm.com/docs/en/qradar-on-cloud?topic=searches-advanced-search-options