IBM IBM Certifications C2150-612 Questions & Answers

• Question 31:

  Which two pieces of information can be found under the Log Activity tab? (Choose two.)

  A. Offenses

  B. Vulnerabilities

  C. Firewall events

  D. Destination Bytes

  E. Internal QRadar messages

  Correct Answer: AD

• Question 32:

  Which approach allows a rule to test for Active Directory (AD) group membership?

  A. Import the AD membership information into the Asset Database using AXIS and use an asset rule test

  B. Use the build-in LDAP integration to execute a search for each event as it is received by the Event Processor to test for group membership

  C. Maintain reference data for the AD group(s) of interest containing lists of usernames and then add rule tests to see if the normalized username is in the reference data

  D. Export the AD group membership information to a CSV file and place it in the /store/AD_mapping.csv

  file on the console, then use the `is a member of AD group' test in the rule

  Correct Answer: A

• Question 33:

  Given the following supplied payload of a supported Juniper device:

  

  Which QRadar normalized fields will be populated?

  A. Policy, Attack, Source IP, Username

  B. Source IP, Destination IP, Destination Port, Protocol

  C. Source Port, Destination Port, Domain, Source Bytes

  D. Source IP, Destination IP, Destination Port, Destination Bytes

  Correct Answer: B

• Question 34:

  What ability does marking a custom property as "optimized" provide?

  A. Allows you to use the custom property in a rule test

  B. Allows you to process events above your license rating

  C. Allows offenses to merge both events and flows into the same offense

  D. Allows for offenses, events and flows to be compared directly in real time

  Correct Answer: A

• Question 35:

  Which filter in the Log and Network Activity tabs is supported by both flows and events?

  A. Source Payload Contains is [Pattern]

  B. Application [Indexed] matches [Application]

  C. Source ID [Indexed] equals any of [IP Address]

  D. Username [Indexed] equals any of [Username]

  Correct Answer: B

• Question 36:

  Which two actions can be performed on the Offense tab? (Choose two.)

  A. Adding notes

  B. Deleting notes

  C. Hiding offenses

  D. Deleting offenses

  E. Creating offenses

  Correct Answer: AC

  Reference: https://www.ibm.com/support/knowledgecenter/en/SS42VS_7.3.0/com.ibm.qradar.doc/ c_qradar_off_mgmt_tasks.html

• Question 37:

  What are two benefits of using a netflow flow source? (Choose two.)

  A. They can include data payload.

  B. They can include router interface information.

  C. They can include usernames involved in the flow.

  D. They can include ASN numbers of remote addresses.

  E. They can include authentication methods used to access the network.

  Correct Answer: BD

  Reference: https://developer.ibm.com/qradar/2018/01/09/qradar-flow-faq/

• Question 38:

  Which capability is common to both Rules and Building Blocks?

  A. Rules and Building Blocks both set the Magnitude of an Event.

  B. Rules and Building Blocks both have the same selection of sets.

  C. Rules and Building Blocks can both be Enabled/Disabled through the GUI.

  D. Rules and Building Blocks both have Actions; Building Blocks do not have Responses.

  Correct Answer: B

• Question 39:

  Which three optional items can be added to the Default and Custom Dashboards without requiring additional licensing? (Choose three.)

  A. Offenses

  B. Log Activity

  C. Risk change

  D. Flow Search

  E. Risk Monitoring

  F. Asset Management

  Correct Answer: ABF

  Reference: https://www.ibm.com/support/knowledgecenter/SS42VS_7.3.1/com.ibm.qradar.doc/ b_qradar_users_guide.pdf

• Question 40:

  What is a difference between Rule Actions and Rule Responses?

  A. Rule Actions are executed when the Rule is Disabled; Rule Responses require the Rule to be Enabled.

  B. Rule Actions are only available for Event and Flow Rules; Rule Responses are available for all Rules.

  C. Rule Actions only directly affect the SIEM internals; Rule Responses may send information to external systems.

  D. Rule Responses are always processed; Rule Actions may be throttled to ensure they are not executed too frequently.

  Correct Answer: C

  Reference: https://www.ibm.com/developerworks/community/forums/html/topic?id=bf259e09-ef91-46b89c1a-08ea47f11a16andps=100