IBM C2150-400 Online Practice Questions and Exam Preparation

IBM C2150-400 Online Questions & Answers

• Question 21:

  Which tab in the QRadar web console allows flows to be monitored and investigated?

  A. Admin
  B. Assets
  C. Offenses
  D. Network Activity
  C. Offenses

  ---

  Reference: ftp://public.dhe.ibm.com/software/security/products/qradar/documents/71MR1/SIEM/CoreDocs/ QRadar_71MR1_GettingStartedGuide.pdf (page 10, offenses tab)

• Question 22:

  Which configuration window defines the maximum number of TCP syslog connections?

  A. Log Sources
  B. System Setting
  C. Console Setting
  D. Deployment Editor
  D. Deployment Editor

• Question 23:

  A customer has developed a custom Universal Device Support Module (uDSM's) for an unsupported device. The customer wants to parse Device Time field which is not in standard format.

  Which parameter should an administrator define in the LSX template in this situation?

  A. ext-time
  B. ext-date
  C. ext-data
  D. ext-devicedate
  C. ext-data

• Question 24:

  You notice the following message in the System Notification Widget on the Dashboard:

  "Unable to automatically detect the associated log source for IP address."

  When you hover over the message, you see this pop-up message:

  

  What is the issue?

  A. There are events coming from IP 127.0.0.1 that cannot be autodiscovered and a Log Source Created
  B. There are events coming from IP 192.168.2.90 that cannot be autodiscovered and a Log Source Created
  C. There are events coming from IP 172.16.77.25 that cannot be autodiscovered and a Log Source Created
  D. There are events coming from hostname red6.color.com that cannot be autodiscovered and a Log Source Created
  C. There are events coming from IP 172.16.77.25 that cannot be autodiscovered and a Log Source Created

• Question 25:

  Which two proxy options are supported by QRadar Auto Update Advanced settings? (Choose two.)

  A. Proxy Port
  B. Proxy Type
  C. Proxy Name
  D. Proxy Category
  E. Proxy Username
  D. Proxy Category
  E. Proxy Username

  ---

  Reference: https://www.ibm.com/support/knowledgecenter/SS42VS_7.2.6/com.ibm.qradar.doc/ t_qradar_adm_conf_auto_update.html

• Question 26:

  From the given event payload format:

  

  You are tasked with creating a Reference Set of the second IPs in the payload. What needs to be done to complete this task?

  A. Create a Custom Event Property to parse the second IP in the payload. From the Log Source config for the above event, choose "add to reference set" and select your reference set.
  B. From the Reference Set Management screen, select "create reference set from Log Source Event". Pick the Log Source from the drop down. Pick the Event Name from the drop down.
  C. From the Reference Set Management screen, select "create reference set from Log Source Event". Pick the Log Source from the drop down. Pick the Custom Event Property from the drop down.
  D. Create a Custom Event Property to parse the second IP in the payload. Create a rule that tests for events from the Log Source that is collecting the above event, and for Rule Response add the Custom Event Property to the Reference Set.
  A. Create a Custom Event Property to parse the second IP in the payload. From the Log Source config for the above event, choose "add to reference set" and select your reference set.

• Question 27:

  Assuming a Squid Proxy has logs in the following format:

  Time elapsed remotehost code/status bytes method URL rfc931 peerstatus/peerhost type And these are some sample logs from a Squid server:

  

  Which regular expression would you use to pull out the bytes field into a custom property?

  A. \w+/\d+\s+(\d+)\s+
  B. \w+/\d+\s+(\d+)\S+
  C. \w+/\d+\S+(\d+)\s+
  D. \w+/\D+\s+(\D+)\s+
  A. \w+/\d+\s+(\d+)\s+

• Question 28:

  In QRadar SIEM, customer wants to tune one of the firewall deny event which shows firewall deny for all events coming from a Syslog Server and has been identified as false positive. The customer clicked on the "false positive" button to tune the specific event.

  What are the traffic directions that will be available during declaring this event as a false positive? (Choose two.)

  A. SourceIP to Local Network
  B. SourceIP to Any Destination
  C. Any source to Any Destination
  D. Destination IP to Local Network
  E. Source IP to Destination Network
  B. SourceIP to Any Destination
  E. Source IP to Destination Network

  ---

  Reference: e ftp://public.dhe.ibm.com/software/security/products/qradar/documents/71MR1/SIEM/ CoreDocs/QRadar_71MR1_TuningGuide.pdf (page 25)

• Question 29:

  Which command will install the patch after mounting the patch file?

  A. /media/updates/setup
  B. /media/updates/installer
  C. /media/updates/setup -patch
  D. /media/updates/installer -patch
  B. /media/updates/installer

  ---

  Reference: http://www-01.ibm.com/support/docview.wss?uid=swg27041545

• Question 30:

  In which two ways can an administrator view all the events that are related to an offense from the Offense Details screen? (Choose two.)

  A. Top 5 Source IPs section
  B. Click on Display > Sources
  C. Click on Display > Destinations
  D. Click on Event/Flow Count field's Events link
  E. Click on Events button in Last 10 Events section
  B. Click on Display > Sources
  D. Click on Event/Flow Count field's Events link