IBM C2150-400 Online Practice Questions and Exam Preparation

IBM C2150-400 Online Questions & Answers

• Question 131:

  Which Permission Precedence should be applied in the Security Profile so the users can see events from the "Windows Servers" log source group and from other log sources that match the destination or source network "Windows"?

  A. No Restrictions
  B. Log Sources Only
  C. Networks OR Log Sources
  D. Networks AND Log Sources
  B. Log Sources Only

• Question 132:

  Which sampling technology provides continuous monitoring of application level traffic flows on all interfaces simultaneously?

  A. Sflow
  B. J-flow
  C. Packeteer
  D. Flowlog file
  A. Sflow

  ---

  Reference: http://www.ibm.com/support/knowledgecenter/SS42VS_7.2.4/com.ibm.qradar.doc_7.2.4/ c_qradar_adm_sflow.html

• Question 133:

  Which line color inside the deployment editor signals that encrypted communication has been selected for the managed hosts in a distributed environment?

  A. Blue
  B. Grey
  C. Black
  D. Yellow
  D. Yellow

• Question 134:

  What is a benefit of enabling indexes on event properties?

  A. Improved Offense Correlation
  B. Improved search performance
  C. Improved Performance of Custom Rules
  D. Improved accuracy of auto-discovery log sources
  B. Improved search performance

• Question 135:

  Which attribute is valid when defining the user roles to provide the necessary access?

  A. Admin: System Administrator
  B. Log Activity: View Custom Rules
  C. Log Activity: Manage Time Series
  D. Network Activity: Maintain custom Rules
  A. Admin: System Administrator

• Question 136:

  What defines the maximum number of objects in network hierarchy?

  A. QRadar patch level
  B. QRadar license key
  C. QRadar release level
  D. QRadar activiation key
  B. QRadar license key

• Question 137:

  A QRadar administrator is developing custom uDSM's for an unsupported device.

  Given this event payload:

  <13> Jan 28 12:57:23 9.77.16.19 AgentDevice=FileForwarder AgentLogFile=logger1.log Payload=January 28,2014 12:53:50 PM GMT+05:30|HOST_CREATE_ERROR|Host{1:testserver40} create failed on array {0:Abc}

  Which regular expression should the administrator define for parsing the hostname "testserfvefr40"?

  A. \w+\s+{.*?\\s}
  B. \w+\s+{\d+\:(\.*?)\}
  C. \w+\s+{\d+\:(\w+)\}
  D. \w+\s+{\d+\:([a-zA-Z]+)\}
  D. \w+\s+{\d+\:([a-zA-Z]+)\}

  ---

  Reference: http://stackoverflow.com/questions/1653425/a-za-z-a-za-z0-9-regular-expression

• Question 138:

  What does Server discovery allow the QRadar administrator to do?

  A. Discover
  B. Define rules for hosts
  C. Create host searches
  D. Populate host definition building blocks
  A. Discover

  ---

  Reference: http://www.juniper.net/techpubs/software/management/strm/2010_0_R1/Admin_STRM.pdf (page 21, see the table, first row, second column, second bulleted point)

• Question 139:

  Which user account in the QRadar host must be used to configure offboard storage?

  A. Root
  B. Admin
  C. Storage
  D. Administrator
  A. Root

• Question 140:

  A customer wants to detect users that logged in from IP addresses in different locations simultaneously. How can the customer achieve this using the QRadar console?

  A. Create a rule to test for login failures from different country with 15 minutes
  B. Create a rule to check for a local login within corporate network and simultaneous remote login
  C. Create a rule to test for 2 or more logins from VPN or AD from different countries within 15 minutes
  D. Create an offense to test for 2 or more logins from VPN or AD from different countries within 15 minutes
  B. Create a rule to check for a local login within corporate network and simultaneous remote login
  C. Create a rule to test for 2 or more logins from VPN or AD from different countries within 15 minutes

  ---

  Reference: http://www.slideshare.net/xKinAnx/presentation-data-security-solutions-certified-ibm-business- partner-for-ibm-qradar-security-intelligence (slide 29)