IBM C2150-614 - IBM Security QRadar SIEM V7.2.7 Deployment Exam
Page: 3 / 12
Total 60 questions
Question #11 (Topic: )
A Deployment Professional needs to create and share a saved search with other users.
What are the requirements for this action?
What are the requirements for this action?
A. The user must be in the Admin role, and the saved search must have at least one Grouped By field.
B. Any user can share a saved search that must have exactly one “Grouped by” field.
C. The user must be in the Admin role, and the saved search must have at least one [indexed] field.
D. Any user can share a saved search that must contain at least one “Grouped By” + and one “[indexed] fields.
Answer: A
Question #12 (Topic: )
In IBM Security QRadar SIEM V7.2.7, the number of Aggregated Data Management Views
were increased.
How many additional views were added?
were increased.
How many additional views were added?
A. 100
B. 120
C. 130
D. 170
Answer: D
Question #13 (Topic: )
A Deployment Professional has a reference list of usernames that is used in rules. The
Deployment Professional needs to be able to remove a username from the reference list
when an offense is detected from a log event.
How can a Deployment Professional accomplish this goal?
Deployment Professional needs to be able to remove a username from the reference list
when an offense is detected from a log event.
How can a Deployment Professional accomplish this goal?
A. As a rule response, select update Reference Set option
B. As a rule response, select remove from Reference Set option
C. As a rule response, select execute custom action in order to call REST-API:UPDATE: /reference_data/sets/{name}
D. As a rule response, select execute custom action in order to call REST-API:REMOVE: /reference_data/sets/{name}/{value}
Answer: B
Question #14 (Topic: )
What is the impact on network bandwidth when selecting 'Global' on a rule instead of
'Local' in a distributed environment?
'Local' in a distributed environment?
A. All events are sent to the QRadar Console for processing and therefore, the QRadar Console uses more bandwidth.
B. All matching events are sent to the QRadar Console for processing and therefore, the QRadar Console uses more bandwidth.
C. All events are sent to each QRadar Event Processor for processing and therefore, all Events Processors use more bandwidth.
D. All matching events are sent to each QRadar Event Processor for processing and therefore, all Event Processor use more bandwidth.
Answer: B
Question #15 (Topic: )
Which two permissions are required to modify custom properties? (Choose two.)
A. Maintain Custom Rules
B. Normalized Event Properties
C. User Defined Flow Properties
D. User Defined Event Properties
E. Normalized Flow Properties
Answer: C,D
