IBM C2150-400 - IBM Security Qradar SIEM Implementation v 7.2.1 Exam
Page: 3 / 35
Total 175 questions
Question #11 (Topic: )
What is a benefit of enabling indexes on event properties?
A. Improved Offense Correlation
B. Improved search performance
C. Improved Performance of Custom Rules
D. Improved accuracy of auto-discovery log sources
Answer: B
Question #12 (Topic: )
What does the message in the System Notification Widget in the Dashboard "Disk Sentry:
Disk usage exceeded WARNING threshold" tell you?
Disk usage exceeded WARNING threshold" tell you?
A. One of your File Systems has exceeded 92%.
B. One of your File Systems has exceeded 95%.
C. One of your File Systems has exceeded 98%.
D. One of your File Systems has exceeded 90%.
Answer: D
Question #13 (Topic: )
Which statement is true with regard to planning QRadar SIEM high availability?
A. The secondary host can be in different subnet as the primary host.
B. The secondary HA host that you want to add to the HA cluster can be a component in another HA cluster.
C. The primary HA host that you want to add to the HA cluster must be a component in another HA cluster.
D. When the IP address of the primary host is reassigned as a cluster virtual IP, the new IP address that youassign to the primary must be in the same subnet.
Answer: D
Question #14 (Topic: )
A flow is sequence of packets that have which common characteristics?
A. Same source, MAC address, flow source and destination IP address
B. Same source IP address, flow source and transport layer port information
C. Same source and destination IP address and transport layer port information
D. Same destination IP address, source bytes and transport layer port information
Answer: D
Question #15 (Topic: )
What does Server discovery allow the QRadar administrator to do?
A. Discover
B. Define rules for hosts
C. Create host searches
D. Populate host definition building blocks
Answer: A
