IBM IBM Certifications C2150-612 Questions & Answers

• Question 51:

  How does a Device Support Module (DSM) function?

  A. A DSM is a configuration file that combines received events from multiple log sources and displays them as offenses in QRadar.

  B. A DSM is a background service running on the QRadar appliance that reaches out to devices deployed in a network for configuration data.

  C. A DSM is a configuration file that parses received events from multiple log sources and converts them to a standard taxonomy format that can be displayed as outputs.

  D. A DSM is an installed appliance that parses received events from multiple log sources and converts them to a standard taxonomy format that can be displayed as outputs.

  Correct Answer: C

  Reference: ftp://public.dhe.ibm.com/software/security/products/qradar/documents/7.3.0/en/ b_qradar_tuning_guide.pdf (32)

• Question 52:

  Which flow fields should be used to determine how long a session has been active on a network?

  A. Start time and end time

  B. Start time and storage time

  C. Start time and last packet time

  D. Last packet time and storage time

  Correct Answer: C

  Flow timestamps are created as traffic are detected and recored by the QRadar Flow Collector. Some flows can last seconds, ie, an email message, file upload, etc, while others may far longer - minutes, hours, or even days, such as an interactive remote session, audio/video stream (Netflix, voip call), or database <> application connection. As these sessions/flows continue over time, they are reported into the system. The original "start time" for each session remains the same, when first detected, while the "last packet time" will update as time passes. The best way to see this is to search for the two ip addresses involved in the session/flow, then search over a longer time window ?you should see multiple records, one that ends for each minute that the session was active. Each minute will also have the byte and packet count, for each minute the flow was active. Reference: https://developer.ibm.com/qradar/2018/01/09/qradar-flow-faq/

• Question 53:

  Which log source and protocol combination delivers events to QRadar in real time?

  A. Sophos Enterprise console via JDBC

  B. McAfee ePolicy Orchestrator via JDBC

  C. McAfee ePolicy Orchestrator via SNMP

  D. Solaris Basic Security Mode (BSM) via Log File Protocol

  Correct Answer: C

• Question 54:

  A mapping of a username to a user's manager can be stored in a Reference Table and output in a search

  or a report.

  Which mechanism could be used to do this?

  A. Quick Search filters can select users based on their manager's name.

  B. Reference Table lookup values can be accessed in an advanced search.

  C. Reference Table lookup values can be accessed as custom event properties.

  D. Reference Table lookup values are automatically used whenever a saved search is run.

  Correct Answer: B

• Question 55:

  What are two characteristics of a SIEM? (Choose two.)

  A. Log Management

  B. System Deployment

  C. Endpoint Software patching

  D. Enterprise User management

  E. Event Normalization and Correlation

  Correct Answer: AE

• Question 56:

  Which QRadar component provides the user interface that delivers real-time flow views?

  A. QRadar Viewer

  B. QRadar Console

  C. QRadar Flow Collector

  D. QRadar Flow Processor

  Correct Answer: B

  Reference: http://www.ibm.com/support/knowledgecenter/en/SS42VS_7.2.7/com.ibm.qradar.doc/ shc_qradar_comps.html

• Question 57:

  Which Anomaly Detection Rule type is designed to test event and flow traffic for changes in short term events when compared against a longer time frame?

  A. Outlier Rule

  B. Anomaly Rule

  C. Threshold Rule

  D. Behavioral Rule

  Correct Answer: B

  Reference: http://www.ibm.com/support/knowledgecenter/en/SS42VS_7.2.7/com.ibm.qradar.doc/ c_qradar_rul_anomaly_detection.html

• Question 58:

  Which device uses signatures for traffic analysis when deployed in a network environment to detect, allow, block, or simulated-block traffic?

  A. Proxy

  B. QRadar

  C. Switch

  D. IDS/IPS

  Correct Answer: D

• Question 59:

  What is a main function of a Cisco Adaptive Security Appliance (ASA)?

  A. A Proxy

  B. A Switch

  C. A Firewall

  D. An Authentication device

  Correct Answer: C

• Question 60:

  What is the largest differentiator between a flow and event?

  A. Events occur at a moment in time while flows have a duration.

  B. Events can be forwarded to another destination, but flows cannot.

  C. Events allow for the creation of custom properties, but flows cannot.

  D. Flows only contribute to local correlated rules, while events are global.

  Correct Answer: A