IBM Security QRadar SIEM V7.5 Deployment - C1000-163 Exam Practice Test

Question 1

What is high-level view of the configuration restore process?

A. >hostcontext is shut down. >All system processes are shut down. >All files are extracted from the backup archive and restored to disk. >Database tables are restored. >All system processes are restored. >hostcontext is restarted.

B. >Hostcontext is shut down. >All files are extracted from the backup archive and restored to disk. >Database tables are restored. >Tomcat is restarted.

C. >Tomcat is shut down. >All system processes are shut down. >All files are extracted from the backup archive and restored to disk. >Database tables are restored. >All system processes are restored. >Tomcat is restarted.

D. >Tomcat is shut down. >All files are extracted from the backup archive and restored to disk. >Database tables are restored. >Tomcat is restarted.

Correct Answer: C

Question 2

What does it mean when a custom rule is partially matched in QRadar?

A. Not all the the tests in the rule were fully matched.

B. The AND NOT operator is set incorrectly in the first test.

C. All the tests in the rule were fully matched.

D. The rule is not fully enabled.

Correct Answer: A

Question 3

For tenant data retention, what is the maximum number of buckets for shared data that can be created per tenant?

A. 2

B. 10

C. 20

D. No limit

Correct Answer: B

Question 4

What must a deployment professional select when defining a new flow source?

A. The source IP address

B. The flow source type

C. The destination port

D. The router brand

Correct Answer: B

Question 5

Which are the time criteria in AQL queries?

A. START, STOP, BETWEEN, LAST

B. START, BETWEEN, LAST, NOW, PARSEDATETIME

C. START, STOP, LAST, NOW, PARSEDATETIME

D. START, STOP, BETWEEN, FIRST

Correct Answer: C

Question 6

What does QRadar attempt to do when the system generates "Accumulator is falling behind" warnings?

A. The events that QRadar processes during that period are categorized as stored.

B. QRadar automatically drops the incoming events and flows during that time period.

C. QRadar tries to aggregate the events and flows during the next 60 seconds.

D. Time-series graphs and reports omit columns for the period when the problem occurred.

Correct Answer: A

Question 7

Which two (2) file formats are available for exporting offenses?

A. TXT

B. XML

C. PDF

D. XLSX

E. CSV

Correct Answer: B,E

Question 8

Which of the following is used to process flows in Qradar?

A. Event Processor

B. Flow Collector

C. Flow Processor

D. Event Collector

Correct Answer: C

Question 9

Which of these is a benefit of the QRadar Assistant Guide Center?

A. Search, sort, and filter available apps by various categories.

B. View the IBM QRadar Twitter feed from IBM Security.

C. View the latest QRadar related questions from IBM developerWorks forums.

D. View tuning and use cases videos recorded by QRadar experts.

Correct Answer: D

Question 10

Which of these is a tenant administrator responsible for?

A. Configure Domain Management

B. Collaborate with the MSSP administrator

C. Create roles and security profiles for tenant administrators and users

D. Access or change the configuration for other tenants

Correct Answer: B

Question 11

After a successful upgrade, which two actions does a deployment professional perform to complete the installation?

A. Disconnect all managed host from the deployment.

B. Clear the browser cache before logging in to the Console.

C. Run mount /media/updates.

D. Delete the SFS file from all appliances.

E. Rebuild the reference data.

Correct Answer: B,D

Question 12

After working on a QRadar Support case, a set of logs is needed for further review.
Where is the script to gather those logs in case you have no UI access?

A. /bin/qradar/support/get_logs.sh

B. /bin/qradar/get_logs.sh

C. /opt/qradar/support/get_logs.sh

D. /opt/qradar/get_logs.sh

Correct Answer: C

Question 13

An administrator needs to add, delete and modify user accounts.
When deleting a user, what dependency checks are carried out?

A. Custom Rules, Report and Search Criteria, Security Roles

B. Custom Rules, Report and Search Criteria, Historical Correlation Profiles

C. Custom Rules, Security Profiles, Report and Search Criteria

D. Custom Rules, Historical Correlation Profiles, Security Profiles

Correct Answer: B

Question 14

The ____________command removes a directory and all files in it.

A. rm -rf

B. rf -rr

C. rf -rm

D. rm -rp

Correct Answer: A

IBM Security QRadar SIEM V7.5 Deployment - C1000-163 Exam Practice Test

Latest Update

Useful Links

Contact Us