IBM IBM Certifications C2150-612 Questions & Answers

• Question 81:

  What is the default reason for closing an Offense within QRadar?

  A. Actioned

  B. Non-Issue

  C. Blocked Traffic

  D. Acceptable Traffic

  Correct Answer: B

  Reference: https://www.ibm.com/support/knowledgecenter/SS42VS_7.2.1/com.ibm.qradar.doc_7.2.1/ t_qradar_closing_offenses.html?pos=2

• Question 82:

  How does flow data contribute to the Asset Database?

  A. Correlated Flows are used to populate the Asset Database.

  B. It provides administrators visibility on how systems are communicating on the network.

  C. Flows are used to enrich the Asset Database except for the assets that were discovered by scanners.

  D. It delivers vulnerability and ports information collected from scanners responsible for evaluating network assets.

  Correct Answer: C

• Question 83:

  Where are events related to a specific offense found?

  A. Offenses Tab and Event List window

  B. Dashboard and List of Events window

  C. Offense Summary Page and List of Events window

  D. Under Log Activity, search for Events associated with an Offense

  Correct Answer: A

• Question 84:

  While on the Offense Summary page, a specific Category of Events associated with the Offense can be

  investigated.

  Where should a Security Analyst click to view them?

  A. Click on Events, then filter on Flows

  B. Highlight the Category and click the Events icon

  C. Scroll down to Categories and view Top 10 Source IPs

  D. Right Click on Categories and choose Filter on Network Activity

  Correct Answer: B

  Reference:

  IBM Security QRadar SIEM Users Guide. Page: 42

• Question 85:

  Which file type is available for a report format?

  A. TXT

  B. DOC

  C. PDF

  D. PowerPoint

  Correct Answer: C

• Question 86:

  What is the default view when a user first logs in to QRadar?

  A. Report Tab

  B. Offense Tab

  C. Dashboard tab

  D. Messages menu

  Correct Answer: C

  Reference: http://www.ibm.com/support/knowledgecenter/SSKMKU/com.ibm.qradar.doc/c_qradar_dash_tab.html

• Question 87:

  What is a Device Support Module (DSM) function within QRadar?

  A. Unites data received from logs

  B. Provides Vendor specific configuration information

  C. Scans log information based on a set of rules to output offenses

  D. Parses event information for SIEM products received from external sources

  Correct Answer: D

• Question 88:

  Which pair of options are available in the left column on the Reports Tab?

  A. Reports and Owner

  B. Reports and Branding

  C. Reports and Report Grouping

  D. Reports and Scheduled Reports

  Correct Answer: B

• Question 89:

  Which QRadar rule could detect a possible potential data loss?

  A. Apply "Potential data loss" on event of flows which are detected by the local system and when any IP is part of any of the following XForce premium Premium_Malware

  B. Apply "Potential data loss" on flows which are detected by the local system and when at least 1000 flows are seen with the same Destination IP and different Source IP in 2 minutes

  C. Apply "Potential data loss" on events which are detected by the local system and when the event category for the event is one of the following Authentication and when any of Username are contained in any of Terminated_User

  D. Apply "Potential data loss" on flows which are detected by the local system and when the source bytes is greater than 200000 and when at least 5 flows are seen with the same Source IP, Destination IP, Destination Port in 12 minutes

  Correct Answer: D

• Question 90:

  When reviewing Network Activity, a flow shows a communication between a local server on port 443, and a

  random, remote port. The bytes from the local destination host are 2 GB, and the bytes from the remote,

  source host address are 40KB.

  What is the flow bias of this session?

  A. Other

  B. Mostly in

  C. Near-same D. Mostly out

  Correct Answer: D