IBM C2150-400 Online Practice Questions and Exam Preparation

IBM C2150-400 Online Questions & Answers

• Question 61:

  Which expression imports all xml files in the report directory if the administrator is configuring a Nessus Scanner?

  A. \xml
  B. 'xml'
  C. *\.xml
  D. */.xml
  C. *\.xml

  ---

  Reference: ftp://public.dhe.ibm.com/software/security/products/qradar/documents/71MR1/SIEM/CoreDocs/ ManagingVAGuide-71MR1.pdf (page 14)

• Question 62:

  A QRadar administrator is sizing a distributed deployment. The deployment has approximately 25,000 events per second and needs at least 7 terabytes of storage. Which architecture is correct?

  A. One 1605 event processor
  B. One 1624 event processor
  C. Two 1605 event processors
  D. Two 1624 event processors
  C. Two 1605 event processors

• Question 63:

  What are the two support formats for exporting an Assets list from QRadar console? (Choose two.)

  A. XML
  B. RTF
  C. PDF
  D. CSV
  E. HTML
  A. XML
  E. HTML

• Question 64:

  Which option is used to set the Secondary host to an active state?

  A. Click on Primary, then click on High Availability > Set System Offline
  B. Click on Secondary, then click on High Availability > Restore System
  C. Click on Secondary, then click on High Availability > Set System Online
  D. Click on HA Cluster, then click on High Availability > Set System Offline
  C. Click on Secondary, then click on High Availability > Set System Online

  ---

  When you set the secondary HA host to Online, the secondary HA host becomes the standby system. If you set the primary HA host to Online while the secondary system is Active, the primary HA host becomes the active system and the secondary HA host automatically becomes the standby system.

• Question 65:

  Which three graph types are available for QRadar Log Manager reports? (Choose three.)

  A. Pie graph
  B. Histogram
  C. Bar graph
  D. Trivial graph
  E. Stacked bar graph
  F. Stacked table graph
  A. Pie graph
  C. Bar graph
  F. Stacked table graph

  ---

  Reference: http://www.juniper.net/techpubs/software/management/strm/2012_0_R2/strm-lm-user- guide.pdf (page 18)

• Question 66:

  A QRadar administrator is sizing a distributed deployment. The deployment has approximately 2 gigabytes of sustained throughput of traffic on a network tap. The network tap is a 10 gigabyte fiber connection. Which architecture is correct?

  A. Qflow Collector 1301
  B. Qflow Collector 1201
  C. Qflow Collector 1310
  D. Qflow Collector 1202
  C. Qflow Collector 1310

• Question 67:

  A QRadar administrator has created a custom rule for investigation of DoS attack on a network using netflow data as well as events coming from a Checkpoint firewall.

  Where should the tests be performed to detect this type of unusual activity?

  A. Perform tests on offenses to detect unusual activity in your network
  B. Perform tests on events and flows to detect unusual activity in your network
  C. Perform tests on events, flows and offenses to detect unusual activity in your network
  D. Perform tests on the events, flows, offenses and results of saved flow or event searches in your network
  C. Perform tests on events, flows and offenses to detect unusual activity in your network

• Question 68:

  Which three tasks can an administrator perform from the QRadar SIEM reports tab? (Choose three.)

  A. Brand reports
  B. Ability to create custom reports
  C. Ability to create custom compliance templates
  D. Present statistics derived from source IP and destination IP
  E. Present measurements and statistics derived from real time data
  F. Present measurements and statistics derived from events, flows and offenses
  B. Ability to create custom reports
  D. Present statistics derived from source IP and destination IP
  F. Present measurements and statistics derived from events, flows and offenses

• Question 69:

  There is a requirement at the customer site to double the default QFlow Maximum Content Capture size. What would be the resulting packet size?

  A. 64 bytes
  B. 128 bytes
  C. 256 bytes
  D. 1024 bytes
  B. 128 bytes

• Question 70:

  What indicates if an offense is flagged for follow-up?

  A. A flag in the Flag column
  B. Follow-up System Notification
  C. Follow-up email notification from that offense
  D. A flag in Offense Note indicating follow-up required
  D. A flag in Offense Note indicating follow-up required

  ---

  Reference: https://www.ibm.com/support/knowledgecenter/SS42VS_7.2.6/com.ibm.qradar.doc/ c_qradar_off_param.html