IBM C1000-018 Online Practice Questions and Exam Preparation

IBM C1000-018 Online Questions & Answers

• Question 51:

  What does the Assets tab provide?

  A unified view of the information that is known about:

  A. network devices.
  B. triggered Offenses.
  C. log sources.
  D. events and flows.
  D. events and flows.

  ---

  Reference: https://www.ibm.com/support/pages/identity-and-how-log-source-events-update-assets-qradar-siem

• Question 52:

  After working with an Offense, an analyst set the Offense as hidden. What does the analyst need to do to view the Offense at a later time?

  A. In the all Offenses view, at the top of the view, select “Show hidden” from the “Select an option” drop-down.
  B. Search for all Offenses owned by the analyst.
  C. Click Clear Filter next to the “Exclude Hidden Offenses”.
  D. In the all Offenses view, select Actions, then select show hidden Offenses.
  C. Click Clear Filter next to the “Exclude Hidden Offenses”.

  ---

  Explanation:

  To clear the filter on the offense list, click Clear Filter next to the Exclude Hidden Offenses search parameter.

  Reference: https://www.ibm.com/docs/fi/qradar-on-cloud?topic=actions-showing-hidden-offenses

• Question 53:

  The administrator had set up several scheduled reports that can be executed by analysts every Monday, and the first day of each month. On Thursday, an executive requests one of the weekly reports. If the analyst executes the report on Thursday, what information will the report contain?

  A. Data from Monday to Sunday from the previous week.
  B. Data from Thursday from the previous week to Wednesday from the current week.
  C. Data from Monday to Thursday from the current week.
  D. Data from Monday to Wednesday from the current week.
  C. Data from Monday to Thursday from the current week.

• Question 54:

  What is the intent of the magnitude of an offense?

  A. It measures the age of the event attached to the offense.
  B. It measures the age of the offense.
  C. It measures the importance of the offense.
  D. It measures the importance of the event attached to the offense.
  B. It measures the age of the offense.

  ---

  Explanation:

  The age of the offense.

  Reference: https://www.ibm.com/docs/en/qsip/7.3.3?topic=management-offense-prioritization

• Question 55:

  What information is displayed in the default “Log Activity” page? (Choose two.)

  A. QID
  B. Protocol
  C. Qmap
  D. Log Source
  E. Event Name
  D. Log Source
  E. Event Name

• Question 56:

  An analyst needs to map a geographic location on all the internal IP addresses.

  Which option defines the functions where the analyst can-setup a geographic location of the network object in Network Hierarchy?

  A. GPS location and Map
  B. Group and IP address
  C. Log Activity and Network Activity
  D. Longitude and Latitude
  B. Group and IP address

  ---

  Reference: https://www.ibm.com/docs/en/qsip/7.4?topic=tasks-network-hierarchy

• Question 57:

  An analyst needs to create a new custom dashboard to view dashboard items that meet a particular requirement. What are the main steps in the process?

  A. Select New Dashboard and enter unique name, description, add items and save.
  B. Select New Dashboard and copy name, add description, items and save.
  C. Request the administrator to create the custom dashboard with required items.
  D. Locate existing dashboard and modify to include indexed items required and save.
  C. Request the administrator to create the custom dashboard with required items.

  ---

  Explanation:

  To create or edit your dashboards, log in as an administrator, click the Dashboards tab, and then click the gear icon. In edit mode, you can create new dashboards, add and remove widgets, edit display values in existing widgets, and reorder

  tabs.

  Reference: https://documentation.solarwinds.com/en/success_center/tm/content/threatmonitor/tm-editdashboards.htm

• Question 58:

  An analyst is investigating an Offense and has found that the issue is that a firewall appears to be misconfigured and has permitted traffic that should be prevented to pass.

  As part of the firewall rule change process, the analyst needs to send the offense details to the firewall team to demonstrate that the firewall permitted traffic that should have been blocked.

  How would the analyst send the Offense summary to an email mailbox?

  A. Find the CRE Event in the Log Activity tab, open the event detail and select ‘Email linked Offense details’ from the ‘Action’ menu.
  B. Search for the events linked to the Offense in the Log Activity tab; Select all events and copy them using CTRL-C then paste into an email client.
  C. Open the Offense in the Offenses tab, select ‘Email’ from the ‘Action’ menu item and, optionally, add some extra information.
  D. Identify the Offense in the Offense list, right click on the Offense and select ‘Custom Action Script’; ‘Offense Mailer’
  B. Search for the events linked to the Offense in the Log Activity tab; Select all events and copy them using CTRL-C then paste into an email client.

• Question 59:

  An analyst is encountering a large number of false positive results. Legitimate internal network traffic contains valid flows and events which are making it difficult to identify true security incidents. What can the analyst do to reduce these false positive indicators?

  A. Create X-Force rules to detect false positive events.
  B. Create an anomaly rule to detect false positives and suppress the event.
  C. Filter the network traffic to receive only security related events.
  D. Modify rules and/or Building Block to suppress false positive activity.
  C. Filter the network traffic to receive only security related events.

• Question 60:

  The graph below shows a time series of a value. A rule has been created which will trigger at the indicated point.

  

  Which type of QRadar rule has been used?

  A. Common Rule
  B. Threshold Rule
  C. Behavioral Rule
  D. Anomaly Rule
  B. Threshold Rule