IBM IBM Certifications C2150-612 Questions & Answers

• Question 61:

  When QRadar processes an event it extracts normalized properties and custom properties.

  Which list includes only Normalized properties?

  A. Start time, Source IP, Username, Unix Filename

  B. Start time, Username, Unix Filename, RACF Profile

  C. Start time, Low Level Category, Source IP, Username

  D. Low Level Category, Source IP, Username, RACF Profile

  Correct Answer: C

• Question 62:

  What is the maximum number of supported dashboards for a single user?

  A. 10

  B. 25

  C. 255

  D. 1023

  Correct Answer: C

  Reference: http://www.ibm.com/support/knowledgecenter/SS42VS_7.2.7/com.ibm.qradar.doc/ c_qradar_custom_dboard.html

• Question 63:

  What is accessible from the Offenses Tab but is not used to present a sorted list of offenses?

  A. Rules

  B. Category

  C. Source IP

  D. Destination IP

  Correct Answer: A

• Question 64:

  What set of Key fields can trigger coalescing?

  A. Source IP address, Source port, Severity, Username, and Event ID

  B. Source IP address, Destination IP address, Destination port, Direction, and Event ID

  C. Source IP address, Destination IP address, Destination port, Username, and Event ID

  D. Destination IP address, Destination port, Relevance, Username, and Low Level Category

  Correct Answer: C

  Reference: http://www-01.ibm.com/support/docview.wss?uid=swg21622709

• Question 65:

  Which three pages can be accessed from the Navigation menu on the Offenses tab? (Choose three.)

  A. Rules

  B. By Category

  C. My Offenses

  D. By Event Name

  E. Create Offense

  F. Closed Offenses

  Correct Answer: ABC

• Question 66:

  What is a capability of the Network Hierarchy in QRadar?

  A. Determining and identifying local and remote hosts

  B. Capability to move hosts from local to remote network segments

  C. Viewing real-time PCAP traffic between host groups to isolate malware

  D. Controlling DHCP pools for segments groups (i.e. marketing, DMZ, VoIP)

  Correct Answer: A

  Reference: http://www.ibm.com/support/knowledgecenter/SS42VS_7.2.7/com.ibm.qradar.doc/ c_qradar_gs_ntwrk_hrchy.html

• Question 67:

  An event is happening regularly and frequently; each event indicates the same target username. There is a rule configured to test for this event which has a rule action to create an offense indexed on the username. What will QRadar do with the triggered rule assuming no offenses exist for the username and no offenses are closed during this time?

  A. Each matching event will be tagged with the Rule name, but only one Offense will be created.

  B. Each matching event will cause a new Offense to be created and will be tagged with the Rule name.

  C. Events will be tagged with the rule name as long as the Rule Response limiter is satisfied. Only one offense will be created.

  D. Each matching event will be tagged with the Rule name, and an Offense will be created if the event magnitude is greater than 6.

  Correct Answer: C

• Question 68:

  What is the difference between TCP and UDP?

  A. They use different port number ranges

  B. UDP is connectionless, whereas TCP is connection based

  C. TCP is connectionless, whereas UDP is connection based

  D. TCP runs on the application layer and UDP uses the Transport layer

  Correct Answer: B

• Question 69:

  Which QRadar component is designed to help increase the search speed in a deployment by allowing more data to remain uncompressed?

  A. QRadar Data Node

  B. QRadar Flow Processor

  C. QRadar Event Collector

  D. Qradar Event Processor

  Correct Answer: A

• Question 70:

  Which three log sources are supported by QRadar? (Choose three.)

  A. Log files via SFTP

  B. Barracuda Web Filter

  C. TLS multiline Syslog

  D. Oracle Database Listener

  E. Sourcefire Defense Center

  F. Java Database Connectivity (JDBC)

  Correct Answer: DEF