IBM C1000-018 IBM QRadar SIEM V7.3.2 Fundamental Analysis Exam Practice Test

Log Activity

Admin

Dashboard

Assets

Index Management

Log Management

Database Management

Event Management

They inspect other QRadar rules.

They detect if QRadar is operating at peak performance and error free.

They detect unusual traffic patterns in the network from the results of saved flow and events.

They run past events and flows through the Custom Rules Engine (CRE) to identify threats or security incidents that already occurred.

The scheduled report needs to be reconfigured.

The analyst needs to delete the scheduled report and create a new one.

The report will get duplicated so the analyst can then run one manually.

The report still generates on the schedule initially configured.

It runs stateless tests first, then runs stateful tests and evaluates the result.

It runs tests based on the criticality of the test, running the critical ones first.

It runs rule tests line-by-line in order, and continues while tests are true.

It runs all rule tests at the same time, and evaluates the result after all tests are complete

Risk tab

Network Activity tab

Offense tab

Vulnerabilities tab

events and flows.

triggered Offenses.

log sources.

network devices.

(Process name) AND /.*exe/

/Process name/AND (/exe) )

/Process name/ AND /.*exe/

"Process name" AND "*exe"

Create X-Force rules to detect false positive events.

Create an anomaly rule to detect false positives and suppress the event.

Filter the network traffic to receive only security related events.

Modify rules and/or Building Block to suppress false positive activity.

Click Clear Filter next to the "Exclude Hidden Offenses".

In the all Offenses view, at the top of the view, select ‘’Show hidden‘’ from the ‘’Select an option‘’ drop- down.

In the al Offenses view, select Actions, then select show hidden Offenses.

Search for all Offenses owned by the analyst

Have users index the shared search criteria for reuse.

Ask the administrator to modify the shared search criteria and test the dashboard.

Enable a new custom dashboard and share it with users.

Create and share the search criteria that the dashboard Item will use.

when a port is opened

when the threat assessment changes

when new events are added to the Offens

when the number of vulnerabilities increases

An Advanced Search uses a saved search, while a Quick Search uses a query language.

A Quick Search displays results by column, while an Advanced Search displays results by Category.

A Quick Search uses a saved search, while an Advanced Search requires a query language.

An Advanced Search displays results by Category, while a Quick Search displays results by column.

When the source is [local or remote]

When the destination is [local or remote]

When the event(s) were detected by one or more of [these log sources]

When an event matches all of the following [Rules or Building Blocks]

Review the Offense summary to investigate the flow and event details.

Review the X-Force rules to investigate the Offense flow and event details.

Review pages of the Asset tab to investigate Offense details.

Review the Vulnerability Assessment tab to investigate Offense details.