IBM C2150-624 Online Practice Questions and Exam Preparation

IBM C2150-624 Online Questions & Answers

• Question 1:

  What must be done when creating a user with a non-admin role on an IBM Security QRadar SIEM V7.2.8 system that is utilizing Active Directory authentication?

  A. Ensure the password has a minimum of 8 characters.
  B. Create the user's initial password and have them change it immediately.
  C. Ensure the user's QRadar password matches their Active Directory password.
  D. A password does not need to be set on QRadar when using Active Directory authentication.
  C. Ensure the user's QRadar password matches their Active Directory password.

• Question 2:

  How are Events and Flows licensed in IBM Security QRadar V7.2.8?

  A. They are both licensed in a `per minute' value.
  B. They are both licensed in a `per second' value.
  C. Events are licensed as a `per second' value and Flows as a `per minute' value.
  D. Events are licensed as a `per minute' value and Flows as a `per second' value.
  D. Events are licensed as a `per minute' value and Flows as a `per second' value.

• Question 3:

  What is the difference between Flows and Event data collected by IBM Security QRadar SIEM V7.2.8?

  A. Events are streamed each minute to the Event Processor. Flows are streamed immediately to the Flow Processor.
  B. Flow data is collected from different log sources. Event data is collected from internal or external network sources.
  C. An Event occurs at a specific time and is logged at that time. A Flow is a record of network activity that can last for seconds, minutes, hours, or days.
  D. An Event can span time lasting seconds, minutes, hours depending on the duration of a network session. A Flow happens at a single point in time and then is complete.
  C. An Event occurs at a specific time and is logged at that time. A Flow is a record of network activity that can last for seconds, minutes, hours, or days.

• Question 4:

  A backup failure occurs on an IBM Security QRadar SIEM V7.2.8 Console or on an Event Processor. Which system notification message can an Administrator configure for an email notification?

  A. Backup: requires more disk space
  B. Backup: unable to process backup request
  C. Backup: last Backup exceeded space threshold
  D. Backup: last Backup reached execution threshold
  A. Backup: requires more disk space

  ---

  Reference: http://www-01.ibm.com/support/docview.wss?uid=swg21691524

• Question 5:

  In which core functional layer of an IBM Security QRadar SIEM V7.2.8 architecture is data parsed and normalized?

  A. Data Searches
  B. Data Collection
  C. Data Processing
  D. Data Management
  B. Data Collection

• Question 6:

  An IBM Security QRadar SIEM V7.2.8 Administrator wants to change the reference set type. What step(s) need to be taken to accomplish this?

  A. Use the CLI with the ReferenceSetUtil.sh script
  B. Recreate the reference set with the new data type
  C. Admin tab -> System Configuration -> Reference: Set Management -> Edit
  D. Admin tab -> System Configuration -> Reference: Set Type Management -> Edit
  C. Admin tab -> System Configuration -> Reference: Set Management -> Edit

• Question 7:

  An Administrator is creating custom rules and configuring log sources on an IBM Security QRadar SIEM V7.2.8 console. This data needs to be retained so that it can be recovered in case of any system failure with minimal effort. Which option can the Administrator utilize from the Backup and Recovery Wizard to accomplish this task?

  A. Data backups
  B. Ariel database
  C. Configuration and Data backups
  D. Configuration and DB2 database
  A. Data backups

• Question 8:

  An Administrator working within IBM Security QRadar SIEM V7.2.8 has created a network hierarchy that includes the following groups and subgroups: Office #1 Group

  -Miscellaneous 10.10.0.0/24

  -Sales 10.10.8.0/24

  -Marketing 10.10.1.0/24

  Office #2 Group

  -Miscellaneous 10.20.0.0/16

  -Sales 10.20.8.0/24

  -Marketing 10.20.1.0/24

  A new subgroup is added to Office #1 having a CIDR of 10.10.50.0/24. Offenses are being triggered and during the investigation, it is noticed the rule should not fire if traffic is L2L. The offense is being triggered on traffic from 10.10.4.17 to

  10.20.1.8.

  Is this rule using the network hierarchy correctly?

  A. This rule is parsing the network hierarchy correctly, as the 10.10.4.17 address is not contained in a group, and therefore is remote.
  B. This rule is parsing the network hierarchy correctly, as the offices are both remotely geo-located, and connecting over the Internet, it is remote traffic.
  C. This rule isn't parsing the network hierarchy correctly, as the network hierarchy contains the CIDR for 10.10.4.17 and 10.20.1.0/24, therefore being L2L traffic.
  D. This rule isn't parsing the network hierarchy correctly, as the network hierarchy contains both subnets, but is viewing traffic between groups to be remote instead of local.
  A. This rule is parsing the network hierarchy correctly, as the 10.10.4.17 address is not contained in a group, and therefore is remote.

• Question 9:

  Which is an officially supported web browser for managing IBM Security QRadar SIEM V7.2.8?

  A. Safari
  B. Vivaldi
  C. Opera Netscape
  D. Mozilla Firefox ESR
  D. Mozilla Firefox ESR

• Question 10:

  After downloading the .sfs file from Fix Central, what is the next step to upgrade IBM Security QRadar SIEM V7.2.8?

  A. Log in to the console as the Admin user-> Admin tab -> Advanced Menu -> Clean SIM Model.
  B. Log in to the console as the Admin user-> Admin tab -> Advanced Menu -> Upgrade option.
  C. Use SSH to log in to the system as the root user -> Run the patch installer with the following command: /media/updates/upgrade_qradar.
  D. Use SSH to log in to the system as the root user -> Copy the patch file to the /tmp directory or to another location that has sufficient disk space.
  D. Use SSH to log in to the system as the root user -> Copy the patch file to the /tmp directory or to another location that has sufficient disk space.