IBM C2150-196 Online Practice Questions and Exam Preparation

IBM C2150-196 Online Questions & Answers

• Question 11:

  Given that ICMP pings from all hosts are dropped, which rule(s) allows ICMP pings and responses only from and to host 10.35.100.23?

  A. iptables -A INPUT-p icmp -j ACCEPT B. i ptables -A OUTPUT-s 10.35.100.23-p i cmp -j ACCEPT
  C. iptables -A OUTPUT-p icmp--icmp-type echo-reply-j ACCEPT
  D. iptables -A INPUT-s 10.35.100.23 -p icmp --icmp-type echo-request-i ACCEPT
  D. iptables -A INPUT-s 10.35.100.23 -p icmp --icmp-type echo-request-i ACCEPT

• Question 12:

  When creating a new IBM Security QRadar SIEMV7.1 user account, the administrator did not give access to the log source group (called MS Domain Security Logs) that contains Microsoft Security Event logs. What happens if the user attempts to run a shared saved search for failed login attempts to a domain?

  A. The user is not able to see any results from that search.
  B. Since the user is part of the domain, they are able to see the data in the search results.
  C. The user is notified that they do not have the proper permissions to run that search and are requested to contact their administrator.
  D. The search will run but since the user was not given access to the MS Domain Security Logs group, the user cannot see results from those log sources contained in that group.
  D. The search will run but since the user was not given access to the MS Domain Security Logs group, the user cannot see results from those log sources contained in that group.

• Question 13:

  What are two ways an asset can be added to asset profiles? (Choose two.)

  A. by flow data
  B. by offense data
  C. by anomaly rule
  D. by search queries
  E. by avulnerability assessment or active network scan
  A. by flow data
  E. by avulnerability assessment or active network scan

• Question 14:

  Prior to installing IBM Security QRadar SIEM V7.1 on customer provided hardware, Red Hat Enterprise Linux must be installed. SELinux must be set to which option?

  A. Enforce
  B. Enabled
  C. Disabled
  D. Permissive
  C. Disabled

• Question 15:

  How are new reference sets created in IBM Security QRadar (QRadar)?

  A. use the out-of-the-box tables
  B. use the Reference SetMod.pI script
  C. select New in the Rules Response Wizard
  D. log into the QRadar Console and the PostgreSQL database
  C. select New in the Rules Response Wizard

• Question 16:

  What two types of retention buckets are available in IBM Security QRadarSEM V7.1? (Choose two.)

  A. Flow
  B. Event
  C. Assets
  D. Offense
  E. Log Source
  A. Flow
  B. Event

• Question 17:

  In which section can event or flow hashingbe enabled/disabled in IBM Security QRadar SIEM V7 .1?

  A. Console
  B. Security
  C. System Setbngs
  D. Deployment Editor
  C. System Setbngs

• Question 18:

  Whatis the purpose of the offense index?

  A. When the offense is created it will create indexes for other offenses.
  B. It helps find the offenses faster when searching for offenses by a specific properly.
  C. When the offense is created it will be added to anyexisting similar open offense with the same indexed value. If none exist, a new offense will be opened.
  D. When the offense is created the magistrate will search for offenses with the same indexed value and add the offense to a list of offenses for the indexed value.
  C. When the offense is created it will be added to anyexisting similar open offense with the same indexed value. If none exist, a new offense will be opened.

• Question 19:

  After configuring external authentication, which user can still log in to the Web interface if this external resource is not available?

  A. root
  B. admin
  C. any user
  D. all users added before switching to external authentication
  B. admin

• Question 20:

  Which family of analysis methods are commonly used with a time series?

  A. deep packet intrusion detection
  B. packet content protocol detection
  C. network behavior anomaly detection
  D. N-gram basedbehavior attack detection
  C. network behavior anomaly detection