IBM C2150-400 Online Practice Questions and Exam Preparation

IBM C2150-400 Online Questions & Answers

• Question 11:

  Which operating system is supported for creating a bootable flash drive for recovery?

  A. Cisco IOS
  B. Florida Linux
  C. Debian Linux
  D. RedHat Linux
  D. RedHat Linux

• Question 12:

  Which three user-defined parameters contributes to the calculation of the Common Vulnerability Scoring System (CVSS) score on QRadar Assets tab? (Choose three.)

  A. Severity Requirement
  B. Security Requirement
  C. Capacity Requirement
  D. Availability Requirement
  E. Confidentiality Requirement
  F. Collateral Damage Potential
  D. Availability Requirement
  E. Confidentiality Requirement
  F. Collateral Damage Potential

  ---

  Reference: http://www.ibm.com/support/knowledgecenter/SS42VS_7.2.3/com.ibm.qradar.doc_7.2.3/ c_qradar_ug_asset_tablist.html?lang=ru

• Question 13:

  A QRadar administrator is sizing a distributed deployment. The deployment has approximately 2 million flows per minute (FPM) and needs at least 7 terabytes of storage.

  Which architecture is correct?

  A. One 1724 flow processor
  B. One 1705 flow processor
  C. Two 1724 flow processors
  D. Two 1705 flow processors
  C. Two 1724 flow processors

• Question 14:

  A customer has log files from Windows-based systems and wants to push those logs to the QRadar console.

  What options should the customer use in WinCollect to collect and forward these logs?

  A. File Forwarder
  B. Flow Forwarder
  C. Event Forwarder
  D. Windows-based Event Log Forwarder
  C. Event Forwarder

• Question 15:

  Which option will display the rule that triggered an offense from Offense Details screen?

  A. Display > Rules
  B. Display > Sources
  C. Offenses tab > Rules
  D. Display > Annotations
  A. Display > Rules

• Question 16:

  What should the format of a CSV file be while importing assets on the QRadar console?

  A. ip,portweight,description
  B. ip,name,weightmagnitude
  C. ip.name.weight.description
  D. ip.name.severity.description
  C. ip.name.weight.description

  ---

  Reference: http://www-03.ibm.com/certify/tests/objC2150-195.shtml (search for name, weight, description)

• Question 17:

  An off-site source can connect to which component?

  A. Flow collector
  B. Event collector
  C. Flow processor
  D. Event processor
  B. Event collector

  ---

  Reference: http://www-01.ibm.com/support/knowledgecenter/SS42VS_7.2.1/com.ibm.qradar.doc_7.2.1/ c_qradar_adm_qradar_siem_component.html?cp=SS42VS_7.2.1%2F4-0-11-3-0andlang=fr (see off-site source)

• Question 18:

  What is used to collect netflow and jflow traffic in a QRadar Distributed Deployment?

  A. QRadar 3124 Console
  B. QRadar 1624 Processor
  C. QRadar 1724 Processor
  D. QRadar 700 Risk Manager
  A. QRadar 3124 Console

• Question 19:

  You have been asked to forward all event logs from QRadar to another central syslog server with the IP of 172.16.77.133. You also want the events to be processed by the CRE, but not stored on the system.

  What will allow you to do this process?

  A. Add a Routing Rule that under Current Filters "Matches All Incoming Events", under Routing Options, add a Forwarding destination for 172.16.77.133 with the "Raw Event" format. Then select the 'Forward' and 'Drop' options. Save and deploy.
  B. Add a Routing Rule that, under Current Filters "Matches All Incoming Events", under Routing Options, add a Forwarding destination for 172.16.77.133 with the "Normalized Event" format. Then select the 'Forward' and 'Drop' options. Save and deploy.
  C. Add a forwarding Destination for 172.16.77.133 with the "Raw Event" format. Then add a Routing Rule that, under Current Filters "Matches All Incoming Events", under Routing Options, select the Forward destination that matches destination you created. Then select the 'Forward' and 'Drop' options. Save and deploy.
  D. Add a forwarding Destination for 172.16.77.133 with the "Normalized Event" format. Then add a Routing Rule that, under Current Filters "Matches All Incoming Events", under Routing Options, select the Forward destination that matches destination you created. Then select the 'Forward* and 'Drop* options. Save and deploy.
  A. Add a Routing Rule that under Current Filters "Matches All Incoming Events", under Routing Options, add a Forwarding destination for 172.16.77.133 with the "Raw Event" format. Then select the 'Forward' and 'Drop' options. Save and deploy.

• Question 20:

  What does QRadar use to group the event or flow according to the network?

  A. Network mapping
  B. Network hierarchy
  C. Application mapping
  D. Application hierarchy
  A. Network mapping