IBM C1000-018 Online Practice Questions and Exam Preparation

IBM C1000-018 Online Questions & Answers

• Question 41:

  How does an analyst view the base64 encoded string of an event's raw payload that contains unprintable characters?

  A. Copy the raw payload and use an external tool to view base64 data
  B. Right click on the event –andgt; view base64 data
  C. Log Activity –andgt; Under Payload Information, click base64 tab
  D. Admin –andgt; Under Payload Information, click base64 tab
  B. Right click on the event –andgt; view base64 data

• Question 42:

  Which filter would an analyst apply in the Log Activity tab to get a list of log sources not reporting to QRadar?

  A. Log source status does not equal active
  B. Custom rule equals device stopped sending events
  C. Log source type does not equal active
  D. Log source status does not equal error
  A. Log source status does not equal active

• Question 43:

  What is the purpose of Anomaly detection rules?

  A. They inspect other QRadar rules.
  B. They detect if QRadar is operating at peak performance and error free.
  C. They detect unusual traffic patterns in the network from the results of saved flow and events.
  D. They run past events and flows through the Custom Rules Engine (CRE) to identify threats or security incidents that already occurred.
  C. They detect unusual traffic patterns in the network from the results of saved flow and events.

  ---

  Reference: https://www.juniper.net/documentation/en_US/jsa7.4.0/jsa-users-guide/topics/concept/concept-jsa-user-anomaly-detection-rules.html#:~:text=Anomaly%20detection%20rules%20test%20the,patterns%20occur%20in%20your% 20network.andtext=Typically%20the%20search%20needs%20to,%2C%20thresholds%2C%20or%20behavior%20changes

• Question 44:

  An analyst is investigating a user's activities and sees that they have repeatedly executed an action which triggers a rule that emails the SOC team and creates an Offense, indexed on Username.

  The SOC team complained that they have received 15 emails in the space of 10 minutes, but the analyst can only see one Offense in the Offenses tab.

  How is this explained?

  A. There is a Rule Limiter on the Rule Action which creates the Offense, this should also be applied to the Rule Responses.
  B. This is expected behavior, the offense will contain the information about all 15 events.
  C. An Offense rule has been configured to send multiple emails upon Offense creation.
  D. The Custom Rules Engine (CRE) has fallen behind and the additional Offenses will be created shortly.
  C. An Offense rule has been configured to send multiple emails upon Offense creation.

• Question 45:

  Which statement about False Positive Building Blocks applies? Using False Positive Building Blocks:

  A. helps to prevent unwanted alerts, but there is no effect on performance.
  B. helps to prevent unwanted alerts, and reduces the performance impact of testing rules that do not need to be tested.
  C. has no impact on unwanted alerts, but it does reduce the performance impact of testing rules that do not need to be tested.
  D. has no impact on unwanted alerts, or performance.
  A. helps to prevent unwanted alerts, but there is no effect on performance.

  ---

  Reference: https://community.carbonblack.com/t5/Knowledge-Base/Cb-Defense-Understanding-Eliminating-Unwanted-Alerts/ta-p/44924

• Question 46:

  When ordering these tests in an event rule, which of them is the best test to place at the top of the list for rule performance?

  A. When the source is [local or remote]
  B. When the destination is [local or remote]
  C. When the event(s) were detected by one or more of [these log sources]
  D. When an event matches all of the following [Rules or Building Blocks]
  A. When the source is [local or remote]

• Question 47:

  There are 5 authentication servers that report to different Event Processors. There is a requirement to generate an Offense if there are 5 consecutive failed logins detected across any of the 5 Event Processors. Which type of rule should the analyst create?

  A. Global Rule
  B. Persistent Rule
  C. Local Rule
  D. Offense Rule
  A. Global Rule

  ---

  Explanation:

  Global rules These rules use the Any domain modifier and run across all tenants.

  Reference: https://www.ibm.com/docs/en/SS42VS_7.3.2/com.ibm.qradar.doc/b_qradar_admin_guide.pdf

• Question 48:

  What information is included in flow details but is not in event details?

  A. Log source information
  B. Number of bytes and packets transferred
  C. Network summary information
  D. Magnitude information
  C. Network summary information

  ---

  Explanation:

  Flows represent network activity by normalizing IP addresses, ports, byte and packet counts, and other data, into flow records, which effectively are records of network sessions between two hosts.

  Reference: https://www.ibm.com/docs/en/qsip/7.3.2?topic=overview-qradar-events-flows

• Question 49:

  What is the reason for this system notification?

  

  A. Deny ntpdate communication on port 423.
  B. Deny ntpdate communication on port 223.
  C. Deny ntpdate communication on port 323.
  D. Deny ntpdate communication on port 123.
  D. Deny ntpdate communication on port 123.

  ---

  Explanation:

  38750129 - Time synchronization to primary or Console has failed.

  The managed host cannot synchronize with the console or the secondary HA appliance cannotsynchronize with the primary appliance.

  Administrators must allow ntpdatecommunication on port 123.

  Reference: https://www.coursehero.com/file/p35nlom9/Process-exceeds-allowed-run-time-38750122-Process-takes-too-long-to-execute-The/

• Question 50:

  Why would an analyst update host definition building blocks in QRadar?

  A. To reduce false positives.
  B. To narrow a search.
  C. To stop receiving events from the host.
  D. To close an Offense
  D. To close an Offense

  ---

  Explanation:

  Building blocks to reduce the number of offenses that are generated by high volume traffic servers.

  Reference: https://www.ibm.com/docs/en/qsip/7.4?topic=phase-qradar-building-blocks