IBM C2150-196 Online Practice Questions and Exam Preparation

IBM C2150-196 Online Questions & Answers

• Question 71:

  A user can be assigned which two permissions? (Choose two.)

  A. DSM Updates
  B. Network Activity
  C. Remote Server Administration
  D. Ariel Database Administration
  E. IP right-click Menu Extensions
  B. Network Activity
  E. IP right-click Menu Extensions

• Question 72:

  Which IBM Security QRadar SIEM V7.1 DSM protocol supports the collection of Microsoft SMTPI OWA, and message tracking logs?

  A. MicrosoftIS
  B. Microsoft DHCP
  C. Microsoft Exchange
  D. Microsoft Security Event Log
  C. Microsoft Exchange

• Question 73:

  How does the order of rule tests affect the ORE performance?

  A. It does not affect the performance.
  B. All tests in a rule are evaluated individually. Tests that have counters affect theORE performance and not the order of tests.
  C. When analyzing the rules in pairs from top to bottom, the test at the top should always be the one most likely to fail because if it fails then ORE will not evaluate the following tests.
  D. When analyzing therules in pairs going from top to bottom, the test at the bottom should always be the test that is most likely to fail. This ensures that the rule evaluation is optimized.
  C. When analyzing the rules in pairs from top to bottom, the test at the top should always be the one most likely to fail because if it fails then ORE will not evaluate the following tests.

• Question 74:

  What is the allowable range for Object Weight when defining a network hierarchy object?

  A. 0-9
  B. 1-5
  C. 1-10
  D. 0-99
  D. 0-99

• Question 75:

  How is a Universal DSM configured to collect different data types from various log sources?

  A. UDSM Data Type
  B. Log Source Identifier
  C. Protocol Configuration
  D. Log Source Extension
  C. Protocol Configuration

• Question 76:

  Which method does WinCollect use to collect Windows 2008 events?

  A. It uses Windows file sharing to pull the Windows 2008 event logs.
  B. It uses the syslog forwarding facility of Windows 2008 Event Logger.
  C. It uses the native Windows 2008 event log API to access the log records.
  D. It uses SNARE toconvert the Windows 2008 events to syslog messages.
  C. It uses the native Windows 2008 event log API to access the log records.

• Question 77:

  Whichstatement best describes the available options when configuring a new routing rule?

  A. A routing rule is defined to associate network configuration with the options for storing the data in the database as well processing events through the rules engine.
  B. A routing rule is used to define to IBM Security QRadar SIEM V7.1 the possible path through the internal network, and how to associate these paths with vulnerability data in the Asset Profiles.
  C. Associate each rule with an event collector, determine placement of the data within the Ariel database, choose the protocol, host, and port number used to store the event, and then determine which alerts are generated.
  D. Scope the rule to a particular event collector, set up a filter, and then choose any combination of forward, drop, or bypassed correlation. It is not necessary to define destinations in advance as that can be done when routing rules are defined.
  D. Scope the rule to a particular event collector, set up a filter, and then choose any combination of forward, drop, or bypassed correlation. It is not necessary to define destinations in advance as that can be done when routing rules are defined.

• Question 78:

  A customer has indicated that Windows events must be collected without the use of agents. Which protocol should be selected in theProtocol Configuration when adding a Microsoft Windows Security Event Log Source?

  A. WinCollect
  B. SNARE for Windows
  C. Adaptive Log Exporter
  D. Microsoft Security Event Log
  D. Microsoft Security Event Log

• Question 79:

  Which statement is true about the IBM Security QRadar SIEM (QRadar) Network Hierarchy?

  A. It is used by QRadar to detect botnets.
  B. It is used by QRadar to detect applications.
  C. It is used by QRadar only totrack network activity.
  D. It is used by QRadar to determine which IP addresses are local and remote.
  D. It is used by QRadar to determine which IP addresses are local and remote.

• Question 80:

  What is a definingcharacteristic of an asymmetric flow?

  A. It is evidenced by receiving varying length NetElow records.
  B. It describes network traffic that is configured to take alternate paths for inbound and outbound traffic.
  C. It describes where traffic volumes are significantly skewed towards either inbound or outbound communication.
  D. It describes network traffic that commonly resolves to a Superflow in the IBM Security QRadar QElow appliance.
  B. It describes network traffic that is configured to take alternate paths for inbound and outbound traffic.