IBM C2150-196 Online Practice Questions and Exam Preparation

IBM C2150-196 Online Questions & Answers

• Question 1:

  What must be done to capture a new name/value pair for a rule that is not parsed as part of a regular Device Support Module?

  A. open the event > Extract Property > assign a new property > Add RegEx for finding the value > Submit
  B. open the event > Actions > Add Custom Property > assign a name > highlight value in the payload > Submit
  C. highlight the event > Actions > Add Custom Property > assign a name> highlight value in the payload > Submit
  D. highlight the event > Actions > Extract Properly > assign a new property > Add RegEx for finding the value > Submit
  A. open the event > Extract Property > assign a new property > Add RegEx for finding the value > Submit

• Question 2:

  This command provides what informationwhen run from an IBM Security QRadar QFlow 1202 appliance: grep `Sent.\ + flows' /var/log/qradar.log?

  A. total number of flows per minute sent to the Event Collector
  B. total number of flows per minute sent to the Event Processor
  C. total number of flowsbeing sent since the system was restarted
  D. total number of flows per second sent to the Plow Collector or console
  A. total number of flows per minute sent to the Event Collector

• Question 3:

  What is the benefit of using server discovery?

  A. Adding log sources is faster.
  B. Constructing a networkhierarchy is easier.
  C. The system is tuned to minimize false positives.
  D. Assets are automatically added to asset profiles
  C. The system is tuned to minimize false positives.

• Question 4:

  What are three types of rules that can be createdusing the Rule Wizard? (Choose three.)

  A. Flow Rule
  B. Event Rule
  C. Offense Rule
  D. Anomaly Rule
  E. Threshold Rule
  F. Behavioral Rule
  A. Flow Rule
  B. Event Rule
  C. Offense Rule

• Question 5:

  How are values mapped in a LSXto parse data from a payload for a UDSM?

  A. quotes (`')
  B. back tics(`)
  C. regular expressions
  D. comma separated (,)
  C. regular expressions

• Question 6:

  How is the WinCollect agent enabled to communicate with the IBM Security QRadar SIEM V7.1 (QRadar) console?

  A. Configure the WinCollect agent to forward syslog events to the QRadar Event Collector.
  B. Supply credentials to connect to the WinCollect agent when creating the Windows log source.
  C. Apply the token created for the WinCollect agent during the WinCollect software installation on the target.
  D. WinCollect log sources collect using the QRadar console as host so the WinCollect agent directly accesses the console.
  C. Apply the token created for the WinCollect agent during the WinCollect software installation on the target.

• Question 7:

  What must be done in order to use the data present on the Log Activity screen for a report?

  A. save search criteria
  B. save search results
  C. save reporting criteria
  D. save search for reporting
  A. save search criteria

• Question 8:

  Which scenario best describes the actions that take place during a restore?

  A. Existing files and database are backed up,archived files and database are restored, the event collection service is restarted.
  B. Tomcat and all system processes are shut down, files and data records are extracted from the backup archive and restored to disk and the database, Tomcat and system processes are restarted.
  C. Tomcat and database processes are shut down, existing files and database are backed up, archive contents are restored to disk and the database, Tomcat and the system processes are restarted.
  D. Existing files and database records are merged with the archived files and database records, Tomcat and system services shut down, the merged records are inserted into their respective file locations and database tables, Tomcat and system services restart.
  B. Tomcat and all system processes are shut down, files and data records are extracted from the backup archive and restored to disk and the database, Tomcat and system processes are restarted.

• Question 9:

  Which statement best describes the supported external storage options in IBM Security QRadar SIEM V7.1(QRadar)?

  A. While QRadar supports NES for external storage, NES is recommended for backups, not for storing active data
  B. QRadar data is located in the /store file system. An off board storage solution can be used to migrate the entire /store file system to an external system for faster performance.
  C. The /store/ariel directory is the most commonly off boarded file system. Subsequently, collected event logs and flow records data can be relocated to external storage using protocols such as SMB.
  D. Any subdirectory in the /store file system can be used as a mount point for external storage device. By creating multiple volumes and mounting /store/ariel/logs and /store/ariel/qflow, storage capabilities can be extended past the 64TB file system limit currently supported by QRadar
  A. While QRadar supports NES for external storage, NES is recommended for backups, not for storing active data

• Question 10:

  Given a multi-host deployment, where are data backups for managed hosts stored?

  A. On the console
  B. In the off-site configured backup location
  C. On machines in the deployment that have the most storage capability
  D. Locally on the managed hosts in their respectively configured backup directory
  D. Locally on the managed hosts in their respectively configured backup directory