Exam Questions and Answers for C1000-026 Study Guide Questions and Answers!
IBM Security QRadar SIEM V7.3.2 Fundamental Administration Certification Sample Questions and Practice Exam
NEW QUESTION 24
What should an administrator do to successfully upgrade an IBM Security QRadar system from an older
- A. Review the release notes and review the architecture.
- B. Verify the upgrade path and update the QRadar apps.
- C. Verify the upgrade path, and review the software, hardware and high availability requirements.
- D. Review the software, hardware and high availability requirements, and consider to update the firmware on
Answer: C
Explanation:
IBM Security QRadar appliances.
Reference:
b_qradar_upgrade.pdf (9)
NEW QUESTION 25
An administrator needs to develop advanced filters to retrieve information from the QRadar System pertaining to the top abnormal events of the most bandwidth-intensive IP addresses.
How can the administrator do this?
- A. Use the IBM DataStudio to create the query
- B. Build an AQL query using the QRadar Scratchpad
- C. Combine GROUP BY and ORDER BY clauses in a single query
- D. Build an AQL query using the QRadar GUI using Assets > Search Filter
Answer: C
Explanation:
Explanation/Reference: https://www.ibm.com/support/knowledgecenter/SS42VS_7.3.1/com.ibm.qradar.doc/ b_qradar_aql.pdf (21)
NEW QUESTION 26
An administrator needs to save a search to use it in the dashboards.
To do so, which search feature does the administrator need to select in the "Include in my Dashboard" checkbox?
- A. Filter events of the last 7 days
- B. Filter events of the last month
- C. Filter events of the last 5 minutes
- D. Group by some property
Answer: D
Explanation:
Reference:
https://www.ibm.com/support/knowledgecenter/en/SS42VS_7.3.3/com.ibm.qradar.doc/ b_qradar_users_guide.pdf (42)
NEW QUESTION 27
To comply with specific regulations, an administrator has been requested to increase asset retention to 365 days.
In which QRadar section can the administrator find the asset retention settings?
- A. Assets Tab / Asset Retention
- B. Admin Tab / Asset Retention
- C. Admin Tab / System settings
- D. Assets Tab / Retention settings
Answer: C
Explanation:
Reference:
t_qradar_adm_asset_tuning_ip_retention.html
NEW QUESTION 28
An administrator logs in to the Offenses tab and finds a large number of new Offenses that need action.
What column in the list of Offenses should the administrator use to prioritize them?
- A. Magnitude
- B. Offense Type
- C. Source IPs
- D. Last Event/Flow
Answer: A
Explanation:
Reference:
https://www.ibm.com/support/knowledgecenter/SS42VS_7.3.2/com.ibm.qradar.doc/ b_qradar_users_guide.pdf (43)
NEW QUESTION 29
An administrator needs to save the nightly QRadar backups on a network storage.
The administrator has established the connection to the network storage.
What should the administrator do next?
- A. Change the Backup Repository Path to the network storage location using the System Settings window.
- B. Change the Backup Repository Path by adding a new Network Activity Rule.
- C. Configure the new network storage using the Assets Manager
- D. Change the Backup Repository Path to the network storage location using the Backup Recovery Configuration window.
Answer: D
Explanation:
Explanation/Reference: http://ftpmirror.your.org/pub/misc/ftp.software.ibm.com/software/security/products/qradar/ documents/7.2.8/en/b_qradar_admin_guide.pdf (146)
NEW QUESTION 30
What is a reason for restarting hostcontext service in QRadar?
- A. A new network hierarchy was uploaded
- B. The host is not responding to deploy requests
- C. A new user was created and it needs to be replicated
- D. A new app was installed
Answer: B
NEW QUESTION 31
An administrator has to change the system hardware clock of the QRadar server. The administrator has already restarted the main services (hostservices, tomcat, hostcontext) and needs to synchronize the QRadar Console time with the QRadar managed hosts.
Which command can the administrator use to accomplish this?
- A. /sbin/hwclock -systohc /opt/qradar/bin/time_sync.sh
- B. /opt/qradar/support/all_servers.sh systemctl restart systemd-timedated.service
- C. /opt/qradar/support/all_servers.sh /opt/qradar/bin/time_sync.sh
- D. /opt/qradar/support/all_servers.sh service ntpd restart
Answer: C
Explanation:
Explanation/Reference: https://www.ibm.com/support/pages/qradar-configuring-ntp-settings-qradar-appliance
NEW QUESTION 32
An administrator logs in to the Offenses tab and finds a large number of new Offenses that need action.
What column in the list of Offenses should the administrator use to prioritize them?
- A. Magnitude
- B. Offense Type
- C. Source IPs
- D. Last Event/Flow
Answer: A
Explanation:
Explanation/Reference: https://www.ibm.com/support/knowledgecenter/SS42VS_7.3.2/com.ibm.qradar.doc/ b_qradar_users_guide.pdf (43)
NEW QUESTION 33
An administrator logs into the QRadar Console to review the stored backup files. There is an exclamation mark beside some files.
What is the cause of this?
- A. Canceled backup files
- B. Corrupted backup files
- C. Incomplete backup files
- D. Missing backup files
Answer: D
NEW QUESTION 34
An administrator would like to extend the functionality of QRadar using an external application.
Which file format is supported to successfully upload an application from the QRadar Console?
- A. .sh
- B. .exe
- C. .tgz
- D. .zip
Answer: D
Explanation:
Reference:
https://www.ibm.com/support/knowledgecenter/en/SS42VS_7.3.1/com.ibm.appfw.doc/b_qradar_appframework_devguide.pdf
NEW QUESTION 35
Which of the following dashboards is a QRadar default Dashboard?
- A. Vulnerability Overview
- B. Threat and Security Monitoring
- C. Monitoring Overview
- D. Compliance and Reporting Monitoring
Answer: B
Explanation:
Reference:
c_qrm_default_dboard.html
NEW QUESTION 36
An administrator plans to deploy multiple log sources that share a common configuration.
How many log sources can be added at one time?
- A. 0
- B. 1
- C. 2
- D. 3
Answer: B
Explanation:
Explanation/Reference: https://www.ibm.com/support/knowledgecenter/SS42VS_DSM/com.ibm.dsm.doc/ t_logsource_bulkadd.html
NEW QUESTION 37
An administrator needs to add the following networks to a QRadar network hierarchy as a single Classless Inter-Domain Routin (CIDR) range:
192.168.64.0/24
192.168.65.0/24
192.168.66.0/24
192.168.67.0/24
What is the correct supernet for these subnets?
- A. Network 192.168.64.0 with subnet mask 255.255.255.0
- B. Network 192.168.64.0 with subnet mask 255.255.252.0
- C. Network 192.168.66.0 with subnet mask 255.255.252.0
- D. Network 192.168.66.0 with subnet mask 255.255.252.0
Answer: A
NEW QUESTION 38
A QRadar administrator added High Availability (HA) to the Event Processor and needs to verify the crossover link status between the primary and secondary hosts.
Which commands can be used to verify the crossover status? (Choose two.)
- A. /opt/qradar/ha/bin/getStatus crossover
- B. /opt/qradar/ha/bin/ha cstate
- C. cat /proc/drbd
- D. /opt/qradar/ha/bin/qradar_nettune.pl crossover status
- E. /opt/qradar/ha/bin/qradar_nettune.pl linkaggr <interface> status
- F. /opt/qradar/ha/bin/ha_getstate.sh
Answer: C,D
Explanation:
Reference:
https://www.ibm.com/developerworks/community/forums/html/topic?id=5c01c198-016d-461ba648-a87cdc445768
NEW QUESTION 39
An administrator modified a configuration setting in the Global System Notifications using the QRadar Console Admin tab.
What is the last step to apply changes?
- A. Deploy Changes
- B. Reload Web Server
- C. Re-login to QRadar console
- D. Restart Services
Answer: A
NEW QUESTION 40
......
C1000-026 certification dumps - IBM Security C1000-026 guides - 100% valid: https://www.torrentexam.com/C1000-026-exam-latest-torrent.html
