IBM C2150-196 Online Practice Questions and Exam Preparation

IBM C2150-196 Online Questions & Answers

• Question 41:

  How does a rule generate a new Correlation Rule Engine (CRE) event?

  A. CRE cannot create events, only log sources can.
  B. By letting it create an offense. Offenses are thesame as CRE events.
  C. By creating a rule response. In the rule response, check the box Generate a New CRE Event.
  D. By forwarding the event as a syslog message to the local event collector using the rule response section.
  C. By creating a rule response. In the rule response, check the box Generate a New CRE Event.

• Question 42:

  Where is the activation key located?

  A. on the documentation CD
  B. on the appliance start screen
  C. in the End User License Agreement
  D. in the documentation package shipped with the server
  D. in the documentation package shipped with the server

• Question 43:

  Where are firewall event details located using the IBM Security QRadar SIEM V7.1 interface?

  A. Admin
  B. Assets
  C. Log Activity
  D. Network Activity
  C. Log Activity

• Question 44:

  What must be done prior to clicking on False Positive if flows or events are being viewed in streaming mode?

  A. click on the Pause button
  B. click on the Refresh button
  C. right-click on the event and click Filter
  D. right-click on the event and click Additional Plug-ins
  A. click on the Pause button

• Question 45:

  What would be considerations for defining a Threshold Rule in the Automated Anomaly Analysis?

  A. a change value and a length of time for accumulation
  B. a time window during the day and a moving averagesmoothing value
  C. a time interval for accumulation and a relative weight for the current observation
  D. a seasonal component, a trend component, and a delta or incremental change value
  A. a change value and a length of time for accumulation

• Question 46:

  What is required to configure users for successful external authentication?

  A. A configured External Authentication type
  B. Users with no account on the IBM Security QRadar SIEM V7.1 (QRadar) appliance
  C. Users with existing accounts onQRadar and a configured External Authentication type
  D. Select which users require external authentication and select the correct authentication type
  C. Users with existing accounts onQRadar and a configured External Authentication type

• Question 47:

  What step must be completed before searching restored data on a newly installed console?

  A. Tomcat must be shut down.
  B. All DSMs and RPMs should be restored.
  C. The host context service should be restarted.
  D. The configuration backup must be restored to the new console.
  D. The configuration backup must be restored to the new console.

• Question 48:

  Which three pieces of information must be supplied to properly set up a system user? (Choose three.)

  A. user role
  B. full name
  C. room number
  D. e-mail address
  E. valid user name
  F. contact phone number
  A. user role
  D. e-mail address
  E. valid user name

• Question 49:

  How is a new UDSM device created?

  A. Admin > Log Sources Extensions > Add > Universal DSM
  B. Admin > Log Source > Add > select Universal DSM as log source type
  C. Log Activity Tab > highlight unknown event > Actions > Create UDSM from this Event
  D. Log Activity Tab > highlight unknown event > right-click and select Create UDSM from this Event
  B. Admin > Log Source > Add > select Universal DSM as log source type

• Question 50:

  What is required toconnect a WinCollect agent to IBM Security QRadar SIEM V7.1?

  A. SSH Keys
  B. domain credentials
  C. user name and password
  D. an authorized services token
  D. an authorized services token