IBM C2150-196 Online Practice Questions and Exam Preparation

IBM C2150-196 Online Questions & Answers

• Question 101:

  IBM Security QRadar SIEM V7.1 can be forced to run an instant backup by selecting which option?

  A. Backup Now
  B. On Demand Backup
  C. Launch On Demand Backup
  D. Configure On Demand Backup
  B. On Demand Backup

• Question 102:

  Which statement best describes the expected increase in forensic capabilities when IBM Security QRadar QFlow (QRadar QFlow) is implemented?

  A. IBM Security QRadar VFlow allows for QRadar QFlow collection on hypervisors such as Microsoft Hyper-V.
  B. QRadar QFlow provides visibility only at layers three and four, providing header information containing only the number of bytes and packets transferred by the SRC and DST.
  C. NetFlow provides deep packet inspection, up to layer seven of the OSI model, giving visibility on application information; whereas. QRadar QFlow only provides visibility at layers three and four.
  D. QRadar QFlow tracks the history of stateful connections and monitors for unique characteristics or properties through deep payload examination of packets, further qualifying the identity of applications.
  D. QRadar QFlow tracks the history of stateful connections and monitors for unique characteristics or properties through deep payload examination of packets, further qualifying the identity of applications.

• Question 103:

  How can ALE be used to collect Windows 2008 events?

  A. Use WinCollect because Windows 2008 is not supported by ALE.
  B. Install ALE on the Windows 2008 and start collecting from the local event log.
  C. Configure the ALE agent to receive forwarded events from the Windows 2008 systems.
  D. Configure Windows 2008 to forward its logs directly to the IBM SecurityQRadar SIEM system.
  B. Install ALE on the Windows 2008 and start collecting from the local event log.

• Question 104:

  The Retention Properties screen provides many configuration items to allow for managing the contents of the retention bucket. Which two items are available for bucketmanagement? (Choose two.)

  A. offsite storage
  B. date of deletion
  C. retention encryption
  D. conditions of deletion
  E. criteria for compression
  D. conditions of deletion
  E. criteria for compression

• Question 105:

  Which Admin setting allows the monitoring of system load over 15 minutes?

  A. System Configuration
  B. System Activity Report
  C. Forwarding Destinations
  D. Global System Notifications
  D. Global System Notifications

• Question 106:

  Which user account is used to log in when installing the activation key?

  A. root
  B. admin
  C. qradar
  D. default
  A. root

• Question 107:

  What must be done first when changing the network settings on a console in a multi- system deployment?

  A. install new patches
  B. reset the SIM model
  C. remove all managed hosts
  D. install a new license for the new IP address
  C. remove all managed hosts

• Question 108:

  What are two ways asymmetric flow support can be enabled? (Choose two.)

  A. use the FlowSource configuration
  B. use the right-click menu option for an affected flow
  C. use the auto-discover capabilities of the log source
  D. use a Custom Rule Engine test for asymmetric flows
  E. use the QFlow Collector Configuration in the deployment editor
  A. use the FlowSource configuration
  E. use the QFlow Collector Configuration in the deployment editor

• Question 109:

  Prom the Dashboard view, the Compliance Overview dashboard >Login Failures by User (real-time) workspace is being reviewed. Which link provides more details about these events?

  A. View in Assets
  B. View in Offenses
  C. View in Log Activity
  D. View in Network Activity
  C. View in Log Activity

• Question 110:

  Which two fields are available for indexing in the Index Management page? (Choose two.)

  A. Asset properties
  B. Flows properties
  C. Events properties
  D. Offenses properties
  E. Vulnerability properties
  B. Flows properties
  C. Events properties