QRadar Sample Questions

QRadar Sample Questions What is the maximum number of dashboards a user can create with IBM Security QRadar SIEM V7.2.8? 10 25 55 255 - 255 What are three protocols that collect flow data from network devices, such as routers, and send this data to IBM Security QRadar SIEM V7.2.8? A. NetFlow, J-Flow and sFlow B. NetFlow, IPFIX and syslog C. NetFlow, rsyslog and sFlow D. NetFlow, Packeteer and syslog - NetFlow, J-Flow and sFlow What is needed to send the same events and flows to separate data centers or geographically separate sites and enable data redundancy in IBM Security QRadar SIEM V7.2.8? A. A Flashcopy or GlobalMirror License. B. A dark fibre network and proper configuration of the backup and recovery feature. C. A load balancer or other method to deliver the same data to mirrored appliances. D. Use the Backup and Recovery automation feature in QRadar and a dedicated fiber channel connection. - A load balancer or other method to deliver the same data to mirrored appliances. An Administrator is adding a log source in IBM Security QRadar SIEM V7.2.8.What required software application that supports the log source should be used for this procedure? A. QRadar QFlow Collector B. QRadar Event Collector C. Device Support Module (DSM) D. IBM X-Force Exchange plug-in for QRadar - Device Support Module (DSM) An Administrator working with IBM Security QRadar SIEM V7.2.8 appliances needs to update firmware.How are the files acquired? A. Firmware updates can be retrieved from IBM developerWorks. B. Refer to support documents to download the firmware approved for QRadar appliances. C. All firmware is automatically downloaded and no Administrator intervention is required. D. All firmware updates are applied as part of the QRadar software patching process, and should not be applied independently. - Refer to support documents to download the firmware approved for QRadar appliances. An Administrator working with a customer looking to add IBM Security QRadar SIEM V7.2.8 into their network, has some requirements. The customer is looking to have 40Tb of raw storage space for events and console data.What appliances allow for this requirement to be met? A. QRadar 3128 Console + QRadar 1410 Data Node B. QRadar 3128 Console + QRadar 1400 Data Node C. QRadar 3118 Console + QRadar 1410 Data Node D. QRadar 3128 Console + QRadar Flow Processor 1728 - QRadar 3128 Console + QRadar 1400 Data Node Which AQL query, when run from IBM Security QRadar SIEM V7.2.8, will show EPS broken down by domains? A. select DOMAINNAME (domainid) as LogSource, sum(eventcount) / ((max(endTime) - min(startTime)) /1000 ) as EPS from events group by domainid order by EPS desc last 24 hours B. select DOMAINNAME (domainqid) as LogSource, sum(eventcount) / ((max(endTime) - min(startTime))/1000 ) as EPS from events group by domainqid order by FPM desc last 24 hours C. select DOMAINNAME (domainid) as LogSource, sum(events) / ((max(endTime) - min(startTime)) /1000 ) as EPS from events group by domainid order by FPM desc last 24 hours D. select DOMAINNAME (domainid) as LogSource, sum(events) / ((max(endTime) - min(startTime)) /1000 ) as EPS from events group by domainid order by EPS desc last 24 hours - select DOMAINNAME (domainid) as LogSource, sum(eventcount) / ((max(endTime) - min(startTime)) /1000 ) as EPS from events group by domainid order by EPS desc last 24 hours Which appliance of the IBM Security QRadar SIEM V7.2.8 family is a specifically used to gather events from local and remote log sources? A. QRadar Event Console B. QRadar QFlow Collector C. QRadar Event Collector D. QRadar Event Processor - QRadar Event Collector Where are the IBM Security QRadar SIEM V7.2.8 log files located? A. /var/ B. /var/log/