IBM C1000-018 Online Practice Questions and Exam Preparation

IBM C1000-018 Online Questions & Answers

• Question 11:

  What are the different flow types in QRadar?

  A. L2L, L2R, R2R, R2L
  B. Standard, Type A, Type B, Type C
  C. Standard, Type 1, Type2, Type 3
  D. Type 1, Type 2, Type 3, Type 4
  B. Standard, Type A, Type B, Type C

  ---

  Reference: https://docplayer.net/19071559-Qradar-siem-7-2-flows-overview.html

• Question 12:

  Which are the supported protocol configurations for Check Point integration with QRadar? (Choose two.)

  A. CHECKPOINT REST API
  B. SYSLOG
  C. JDBC
  D. SFTP
  E. OPSEC/LEA
  B. SYSLOG
  E. OPSEC/LEA

• Question 13:

  When an analyst sees the system notification “The appliance exceeded the EPS or FPM allocation within the last hour”, how does the analyst resolve this issue? (Choose two.)

  A. Delete the volume of events and flows received in the last hour.
  B. Adjust the license pool allocations to increase the EPS and FPM capacity for the appliance.
  C. Tune the system to reduce the volume of events and flows that enter the event pipeline.
  D. Adjust the resource pool allocations to increase the EPS and FPM capacity for the appliance.
  E. Tune the system to reduce the time window from 60 minutes to 30 minutes.
  B. Adjust the license pool allocations to increase the EPS and FPM capacity for the appliance.
  C. Tune the system to reduce the volume of events and flows that enter the event pipeline.

  ---

  Explanation:

  User response

  Adjust the license pool allocations to increase the EPS and FPM capacity for the appliance.

  Tune the system to reduce the volume of events and flows that enter the event pipeline.

  Reference: https://www.ibm.com/docs/en/qsip/7.3.2?topic=appliances-maximum-events-flows-reached

• Question 14:

  Where can an analyst working with Offenses add a regular expression test into an existing rule?

  A. Left
  B. Top
  C. Bottom
  D. Right
  B. Top

• Question 15:

  What event information within an offense would provide the analyst with a deep insight as to how it was created?

  A. Event Category
  B. Event QID
  C. Event Payload
  D. Event Magnitude
  D. Event Magnitude

• Question 16:

  How many normalized timestamp field(s) does an event contain?

  A. 2
  B. 3
  C. 4
  D. 1
  B. 3

  ---

  Explanation:

  There are 3 timestamp fields on events in Qradar.

  Reference: https://www.ibm.com/mysupport/s/question/0D50z00006PEG2mCAH/why-do-i-see-different-time-stamps-for-qradar-events?language=en_US

• Question 17:

  An analyst needs to review additional information about the Offense top contributors, including notes and annotations that are collected about the Offense. Where can the analyst review this information?

  A. In the top portion of the Offense Summary window
  B. In the bottom portion of the Offense main view
  C. In the bottom portion of the Offense Summary window
  D. In the top portion of the Offense main view
  C. In the bottom portion of the Offense Summary window

  ---

  Explanation:

  In the bottom portion of the Offense Summary window, review additional information about the offense top contributors, including notes and annotations that are collected about the offense.

  Reference: https://www.ibm.com/docs/en/qsip/7.4?topic=investigations-investigating-offense-by-using-summary-information

• Question 18:

  An analyst has to perform an export of events within a timeframe, but not all the columns are present in the log view for the time period the analyst has selected. The analyst only needs specific columns exported for an external analysis. How can the analyst accomplish this task?

  A. Edit the search and select the extra columns, then export the result with Action/Export to XML/Full Export. This export is only supported in XML.
  B. Edit the search and select the extra columns, then export the result with Action/Export to XML/Visible Columns. This export is only supported in XML.
  C. Edit the search result and select the extra columns, then export the result with Action/Export to CSV/Full Export.
  D. Edit the search result and select the extra columns, then export the result with Action/Export to CSV/Visible Columns.
  D. Edit the search result and select the extra columns, then export the result with Action/Export to CSV/Visible Columns.

  ---

  Reference: https://www.ibm.com/docs/en/qsip/7.4?topic=investigation-exporting-events

• Question 19:

  Which QRadar component stored Offenses?

  A. Console
  B. Data Node
  C. Event Processor
  D. Event Collector
  B. Data Node

  ---

  Explanation:

  QRadar Data Node

  Data Nodes enable new and existing QRadar deployments to add storage and processing capacity on demand as required. Data Nodes help to increase the search speed in your deployment by providing more hardware resources to run

  search queries on.

  Reference: https://www.ibm.com/docs/en/qsip/7.4?topic=overview-qradar-components

• Question 20:

  An analyst investigates an Offense that will need more research to outline what has occurred. The analyst marks a ‘Follow up’ flag on the Offense. What happens to the Offense after it is tagged with a ‘Follow up’ flag?

  A. Only the analyst issuing the follow up flag can now close the Offense.
  B. New events or flows will not be applied to the Offense.
  C. A flag icon is displayed for the Offense in the Offense view.
  D. Other analysts in QRadar get an email to look at the Offense.
  C. A flag icon is displayed for the Offense in the Offense view.

  ---

  Explanation:

  The offense now displays the follow-up icon in the Flag column.

  Reference: https://www.ibm.com/docs/en/qsip/7.4?topic=actions-marking-offense-follow-up