IBM C1000-018 Online Practice Questions and Exam Preparation

IBM C1000-018 Online Questions & Answers

• Question 31:

  An analyst needs to investigate an Offense and navigates to the attached rule(s).

  Where in the rule details would the analyst investigate the reason for why the rule was triggered?

  A. Rule response limiter
  B. List of test conditions
  C. Rule actions
  D. Rule responses
  A. Rule response limiter

• Question 32:

  While creating a new custom property, which is a valid property type selection?

  A. Flow Based
  B. Event Based
  C. AQL Based
  D. Regular Expressions Based
  D. Regular Expressions Based

• Question 33:

  An analyst wants to view information about repeated offenders and IP addresses that generate many attacks or are subject to many attacks. What should the analyst choose from the navigation options in the Offense tab?

  A. By Event Category or By Event Source
  B. By Source IP or By Destination IP
  C. By Log Source IP or By Event Source
  D. By Event or By Flows
  B. By Source IP or By Destination IP

  ---

  Explanation:

  Use the navigation options on the left to view the offenses from different perspectives. For example, select By Source IP or By Destination IP.

  Reference: https://www.ibm.com/docs/en/SS42VS_7.3.3/com.ibm.qradar.doc/b_qradar_users_guide.pdf

• Question 34:

  An analyst has observed that for a particular user, authentication to an organization's critical server is different than the normal access pattern. How can the analyst verify that all the authentications initiated from the user are valid?

  A. Perform a search with filter Destination IP group by Username, then validate the Username
  B. Perform a search with filter Source IP group by Username, then validate the Username
  C. Perform a search with filter Username group by Source IP, then validate the Destination IP
  D. Perform a search with filter Username group by Source IP, then validate the Source IP
  B. Perform a search with filter Source IP group by Username, then validate the Username

• Question 35:

  An analyst aims to improve the detection capabilities on all the Offense rules. QRadar SIEM has a tool that allows the analyst to update all the Building Blocks related to Host and Port Definition in a single page. How is this accomplished?

  A. Admin –andgt; Reference Set management
  B. Assets –andgt; Asset Profiles
  C. Assets –andgt; Server Discovery
  D. Admin –andgt; Asset Profile Configuration
  C. Assets –andgt; Server Discovery

• Question 36:

  An analyst needs to perform a Quick search to find events under the Log Activity tab that contains an ‘exe’ file during a certain time period. How can the analyst do this?

  A. On the Search bar select Quick Filter, then insert filter criteria for ‘/*.exe/’ and then select a time interval from the view option's drop down.
  B. Select Search – New Search from the menu bar, then select all the search criteria required from the UI options provided.
  C. Select Quick Searches on the menu bar, then go through the list of saved searches available to see if one already exists, that can be altered.
  D. On the Search bar select Quick Filter, insert: ‘exe, last 1 hour’ into the filter criteria, then click Search.
  A. On the Search bar select Quick Filter, then insert filter criteria for ‘/*.exe/’ and then select a time interval from the view option's drop down.

  ---

  Reference: https://www.ibm.com/support/pages/searching-your-qradar-data-efficiently-part-1-quick-filters

• Question 37:

  Which use case type is appropriate for VPN log sources? (Choose two.)

  A. Advanced Persistent Threat (APT)
  B. Insider Threat
  C. Critical Data Protection
  D. Securing the Cloud
  A. Advanced Persistent Threat (APT)
  B. Insider Threat

  ---

  Reference: https://www.ibm.com/docs/en/dsm?topic=management-threat-use-cases-by-log-source-type

• Question 38:

  An analyst wants to analyze the long-term trending of data from a search. Which chart would be used to display this data on a dashboard?

  A. Bar Graph
  B. Time Series chart
  C. Pie Chart
  D. Scatter Chart
  A. Bar Graph

  ---

  Explanation:

  You could use a bar graph if you want to track change over time as long as the changes are significant.

  Reference: https://www.statisticshowto.com/probability-and-statistics/descriptive-statistics/bar-chart-bar-graph-examples/

• Question 39:

  An analyst needs to investigate why an Offense was created. How can the analyst investigate?

  A. Review the Offense summary to investigate the flow and event details.
  B. Review the X-Force rules to investigate the Offense flow and event details.
  C. Review pages of the Asset tab to investigate Offense details.
  D. Review the Vulnerability Assessment tab to investigate Offense details.
  A. Review the Offense summary to investigate the flow and event details.

• Question 40:

  An analyst needs to perform Offense management.

  In QRadar SIEM, what is the significance of “Protecting” an offense?

  A. Escalate the Offense to the QRadar administrator for investigation.
  B. Hide the Offense in the Offense tab to prevent other analysts to see it.
  C. Prevent the Offense from being automatically removed from QRadar.
  D. Create an Action Incident response plan for a specific type of cyber attack.
  C. Prevent the Offense from being automatically removed from QRadar.

  ---

  Explanation:

  Protecting offenses:

  You might have offenses that you want to retain regardless of the retention period. You can protect offenses to prevent them from being removed from QRadar after the retention period has elapsed.

  Reference: https://www.ibm.com/docs/en/SS42VS_7.3.2/com.ibm.qradar.doc/b_qradar_users_guide.pdf