IBM C2150-624 Online Practice Questions and Exam Preparation

IBM C2150-624 Online Questions & Answers

• Question 1:

  An Administrator working with a IBM Security QRadar V7.2.8 deployment is looking to add Layer-7 visibility and data collection. The current deployment is running a QRadar 3128-C Console and has 8Gbps of network traffic. What appliance solution would give this customer the results they are looking for?

  A. Adding an additional QRadar 3128-C Console
  B. Adding two QRadarQFlow Collector 1301 appliances
  C. Adding a single QRadarQFlow Collector 1310 SR-C/LR-C
  D. Adding two QRadarQFlow Collector 1301 appliances and one QRadarQFlow Collector 1202 appliance
  D. Adding two QRadarQFlow Collector 1301 appliances and one QRadarQFlow Collector 1202 appliance

• Question 2:

  Where are the IBM Security QRadar SIEM V7.2.8 errors logged?

  A. /var/log/qradar.error
  B. /var/log/qradar/error.log
  C. /opt/qradar/log/qradar.error
  D. /opt/qradar/support/qradar.log
  A. /var/log/qradar.error

  ---

  explanation:

  Reference: https://www.ibm.com/support/knowledgecenter/SS42VS_7.3.1/com.ibm.qradar.doc/c_qradar_siem_inst_logs.html

• Question 3:

  An Administrator has begun configuring the network hierarchy for a customers deployment of IBM Security QRadar SIEM V7.2.8 and has already configured groups for network devices and network management devices, non-routable internal

  address space, DMZ and VPN.

  Which additional item could be considered for configuration within the network hierarchy?

  A. VoIP
  B. Root DNS Servers
  C. External trusted FQDNs
  D. Routable external address spaces
  B. Root DNS Servers

• Question 4:

  An Administrator working with IBM Security QRadar SIEM V7.2.8 is modifying the network hierarchy to contain a few new subnets contained with the 192.0.0.0/26 range. What is a valid host range contained in this range?

  A. 192.0.0.1 -> 192.0.0.62
  B. 192.0.0.1 -> 192.0.0.65
  C. 192.0.0.128 -> 192.0.0.192
  D. 192.0.0.192 -> 192.0.0.254
  A. 192.0.0.1 -> 192.0.0.62

• Question 5:

  An Administrator working with IBM Security QRadar SIEM V7.2.8 needs to configure the deployment to add a log source from IBM Bluemix. What protocol is supported for this?

  A. JDBC
  B. LEEF
  C. WinCollect
  D. TLS Syslog
  D. TLS Syslog

• Question 6:

  An Administrator using IBM Security QRadar SIEM V7.2.8 is using the following RegEx to extract an email address:

  (.+@[^\.].*\.[a-z]{2,}$)

  What does the "[a-z]" portion capture?

  A. The literal string "a-z".
  B. The letter a or the letter z.
  C. Any lower case letter from b to y.
  D. Any lower case letter from a to z.
  A. The literal string "a-z".

• Question 7:

  In which core functional layer of an IBM Security QRadar SIEM V7.2.8 architecture is data parsed and normalized?

  A. Data Searches
  B. Data Collection
  C. Data Processing
  D. Data Management
  B. Data Collection

• Question 8:

  An IBM Security QRadar SIEM V7.2.8 Administrator is given a file to import asset information directly to the asset database. What should the Administrator be aware of when using this data source?

  A. The asset data being imported must contain one field no longer than 255 characters in length.
  B. The asset data imported will have a default retention period of 120 days until flow data is received from the asset.
  C. The asset reconciliation stage is bypassed and asset updates that are provided by users do not introduce asset growth deviations.
  D. The asset data from users are paired with an asset based on a single identifier, the IP address and flow data is never the cause of asset growth deviations.
  C. The asset reconciliation stage is bypassed and asset updates that are provided by users do not introduce asset growth deviations.

• Question 9:

  An Administrator working with IBM Security QRadar SIEM V7.2.8 needs to limit the networking team to see just the Network Flow functions. What should the Administrator do?

  A. Create a user with access to the Log Activity tab.
  B. Create a user role with Network Activity -> View Flow Content.
  C. Create a user role with Network Activity -> View Reference: Data.
  D. Create a user role which grants access to all the functions in the Network Activity tab.
  B. Create a user role with Network Activity -> View Flow Content.

• Question 10:

  An IBM Security QRadar SIEM V7.2.8 Administrator wants to change the reference set type. What step(s) need to be taken to accomplish this?

  A. Use the CLI with the ReferenceSetUtil.sh script
  B. Recreate the reference set with the new data type
  C. Admin tab -> System Configuration -> Reference: Set Management -> Edit
  D. Admin tab -> System Configuration -> Reference: Set Type Management -> Edit
  C. Admin tab -> System Configuration -> Reference: Set Management -> Edit