IBM C2150-400 Online Practice Questions and Exam Preparation

IBM C2150-400 Online Questions & Answers

• Question 81:

  What is the result when adding host definition building blocks to QRadar?

  A. Creates Offenses
  B. Reduces false positives
  C. Makes searches run faster
  D. Authorizes QRadar Services
  B. Reduces false positives

• Question 82:

  Which flow source is sampled?

  A. sFlow
  B. PCAP
  C. QFlow
  D. Flog log file
  A. sFlow

  ---

  Reference: http://www.ibm.com/support/knowledgecenter/SS42VS_7.2.6/com.ibm.qradar.doc/ c_qradar_adm_sflow.html

• Question 83:

  What is QRadar QFlow Collector combined with QRadar SIEM designed to do?

  A. Encryption
  B. Netflow collection
  C. Syslog forwarding
  D. Layer 7 application visibility
  B. Netflow collection

  ---

  QRadar QFlow Collector - Collects data from devices, and various live and recorded feeds, such as network taps, span/mirror ports, NetFlow, and QRadar SIEM flow logs. When the data is collected, the QRadar QFlow Collector groups related individual packets into a flow. QRadar SIEM defines these flows as a communication session between two pairs of unique IP address and ports that use the same protocol. A flow starts when the QRadar QFlow Collector detects the first packet with a unique source IP address, destination IP address, source port, destination port, and other specific protocol options that determine the start of a communication. Each additional packet is evaluated. Counts of bytes and packets are added to the statistical counters in the flow record. At the end of an interval, a status record of the flow is sent to an Event Collector and statistical counters for the flow are reset. A flow ends when no activity for the flow is detected within the configured period of time.

  Flow reporting generates records of all active or expired flows during a specified period of time. If the protocol does not support port-based connections, QRadar SIEM combines all packets between the two hosts into a= single flow record. However, a QRadar QFlow Collector does not record flows until a connection is made to another QRadar SIEM component and data is retrieved.

• Question 84:

  Which two options are available for Override parameter when an administrator views the Asset Profile Summary page? (Choose two.)

  A. Forever
  B. Until Next Scan
  C. After Next Scan
  D. Before Next Scan
  E. After Specified Time
  A. Forever
  B. Until Next Scan

  ---

  Reference: ftp://public.dhe.ibm.com/software/security/products/qradar/documents/71MR1/SIEM/CoreDocs/ QRadar_71MR1_UserGuide.pdf (226, see the table 7th row, second column)

• Question 85:

  What is used to collect netflow and jflow traffic in a QRadar Distributed Deployment?

  A. QRadar 3105 Console
  B. QRadar 1705 Processor
  C. QRadar 1605 Processor
  D. QRadar 700 Risk Manager
  A. QRadar 3105 Console

  ---

  Reference: http://www.arrowecs.ae/FMS/16966.appliance_datasheet.pdf (page 3)

• Question 86:

  What is the easiest method to populate host definition building blocks?

  A. Setup Rules
  B. Server Discovery
  C. Authorized Services
  D. Manually Define Building Blocks
  A. Setup Rules

• Question 87:

  Which IP address of a NATed server is used to access the server from outside the network?

  A. Public IP address
  B. Private IP address
  C. Cluster IP address
  D. Secondary IP address
  A. Public IP address

• Question 88:

  Which view option allows you to view events as they occur?

  A. Automatic
  B. Live Events
  C. Real Time (streaming)
  D. Last Interval (auto refresh)
  C. Real Time (streaming)

  ---

  Reference: http://www.ibm.com/support/knowledgecenter/SS42VS_7.2.3/com.ibm.qradar.doc_7.2.3/ t_qradar_view_normal_event.html

• Question 89:

  Which two authentication methods for the QRadar User Interface are valid? (Choose two.)

  A. SecureID
  B. Client Certificates
  C. System Authentication
  D. Extensible Authentication Protocol (EAP)
  E. Lightweight Directory Access Protocol (LDAP)
  C. System Authentication
  E. Lightweight Directory Access Protocol (LDAP)

  ---

  Reference: ftp://public.dhe.ibm.com/software/security/products/qradar/documents/71MR1/SIEM/CoreDocs/ QRadar_71MR1_AdminGuide.pdf (31, 32)

• Question 90:

  Which icon on the Admin tab do you select when setting up QRadar to use an external authentication method?

  A. Users
  B. Authentication
  C. System Settings
  D. Authorized Services
  C. System Settings