IBM QRadar SIEM C1000-055 Practice Test Questions

1. C1000-055 Free Questions C1000-055 Free Questions IBM QRadar SIEM V7.3.2 Deployment IBM QRadar SIEM V7.3.2 Deployment https://www.passquestion.com/ https://www.passquestion.com/C1000-055 C1000-055.html .html

2. Question 1 Question 1 A client uses the IBM Security QRadar Vulnerability Manager to discover vulnerabilities A client uses the IBM Security QRadar Vulnerability Manager to discover vulnerabilities on the network devices, applications, and software. They run the QRadar Vulnerability on the network devices, applications, and software. They run the QRadar Vulnerability Manager from an All-in-one system, where the scanning and processing functions are on Manager from an All-in-one system, where the scanning and processing functions are on the Console. As the client's QRadar deployment is growing, they are also considering the Console. As the client's QRadar deployment is growing, they are also considering deploying scanners. deploying scanners. What is a valid client motivation for deploying additional scanners? What is a valid client motivation for deploying additional scanners? A. To scan an asset in the same geographic region as the QRadar Vulnerability Manager A. To scan an asset in the same geographic region as the QRadar Vulnerability Manager processor. processor. B. To patch assets for their vulnerabilities. B. To patch assets for their vulnerabilities. C. To avoid scanning through a firewall that is a log source. C. To avoid scanning through a firewall that is a log source. D. To find more vulnerabilities on a given system. D. To find more vulnerabilities on a given system. Answer: D Answer: D

3. Question 2 Question 2 A deployment professional found the System Activity Reporting (SAR) notifications alert A deployment professional found the System Activity Reporting (SAR) notifications alert "Performance degradation was detected in the event pipeline. Expensive DSM extensions were "Performance degradation was detected in the event pipeline. Expensive DSM extensions were found". From the Log Sources under date creation, it can be seen that a new DSM was installed by found". From the Log Sources under date creation, it can be seen that a new DSM was installed by another team member today. another team member today. To troubleshoot this issue, what steps can the deployment professional take? (Choose two) To troubleshoot this issue, what steps can the deployment professional take? (Choose two) A. Review the debug file /var/log/qradar.dsm.debug A. Review the debug file /var/log/qradar.dsm.debug B. Review the payload of the notification to determine which expensive DSM extension in the B. Review the payload of the notification to determine which expensive DSM extension in the pipeline affects performance. pipeline affects performance. C. Ensure that the log source extension is applied to all of the log sources. C. Ensure that the log source extension is applied to all of the log sources. D. Run the DSM Editor and select Optimize over DSM payload to correct this error. D. Run the DSM Editor and select Optimize over DSM payload to correct this error. E. Order your log source parsers from the log sources with the most sent events to the least and E. Order your log source parsers from the log sources with the most sent events to the least and disable unused parsers. disable unused parsers. Answer: B Answer: B

4. Question 3 Question 3 A customer is building a big data solution which aims to perform long term analysis of security data. A customer is building a big data solution which aims to perform long term analysis of security data. Security events that are processed by QRadar are also relevant for the system and according to the Security events that are processed by QRadar are also relevant for the system and according to the QRadar administrator the most straightforward option for data ingestion is to configure event QRadar administrator the most straightforward option for data ingestion is to configure event forwarding on QRadar. The customer would like to make use of QRadar's parsing capability and its forwarding on QRadar. The customer would like to make use of QRadar's parsing capability and its built-in parsers instead of developing new parsers for the big data platform. A deployment built-in parsers instead of developing new parsers for the big data platform. A deployment professional is asked for advice about the data format to configure for the event forwarding. professional is asked for advice about the data format to configure for the event forwarding. Which available option should the deployment professional propose? Which available option should the deployment professional propose? A. Normalized A. Normalized B. Payload B. Payload C. XML C. XML D. JSON D. JSON Answer: A Answer: A

5. Question 4 Question 4 A deployment professional decides to improve visibility in the network and successfully installs the A deployment professional decides to improve visibility in the network and successfully installs the Flow Collector. Flow Collector. What should the deployment professional connect the Flow Collector to? What should the deployment professional connect the Flow Collector to? A. WAN port A. WAN port B. SPAN port B. SPAN port C. LAN port C. LAN port D. SAN port D. SAN port Answer: B Answer: B

6. Question 5 Question 5 A deployment professional needs to configure the IBM QRadar systems so that data is forwarded to A deployment professional needs to configure the IBM QRadar systems so that data is forwarded to one or more vendor systems, such as ticketing or alerting systems. one or more vendor systems, such as ticketing or alerting systems. Which event format options can the deployment professional use for forwarding destination Which event format options can the deployment professional use for forwarding destination configuration? configuration? A. payioad, normalized and json A. payioad, normalized and json B. leef, json and cef B. leef, json and cef C. normalized, json and cef C. normalized, json and cef D. json, cef and payload D. json, cef and payload Answer: C Answer: C

7. Question 6 Question 6 Some customers do not fully understand the benefits of using dedicated appliances to collect events Some customers do not fully understand the benefits of using dedicated appliances to collect events and flows, complaining about the complexity of the deployments. and flows, complaining about the complexity of the deployments. How should the deployment professional clarify any doubts that may arise? How should the deployment professional clarify any doubts that may arise? A. Using All-in-One appliances are a good choice for environments greater than 100.000 EPS. A. Using All-in-One appliances are a good choice for environments greater than 100.000 EPS. B. Event Processor collect events from various log sources and continuously forwards these events to B. Event Processor collect events from various log sources and continuously forwards these events to an Event Collector. an Event Collector. C. Dedicated event collectors when deployed in VMs include an on-board event processor that can C. Dedicated event collectors when deployed in VMs include an on-board event processor that can be directly attached to an All-in-One Virtual console type 3199. be directly attached to an All-in-One Virtual console type 3199. D. The operation of the QRadar security intelligence platform consists of three layers, and applies to D. The operation of the QRadar security intelligence platform consists of three layers, and applies to any QRadar deployment structure, regardless of its size and complexity. any QRadar deployment structure, regardless of its size and complexity. Answer: A Answer: A

8. Question 7 Question 7 A deployment professional sees that there are occasional spikes in the EPS A deployment professional sees that there are occasional spikes in the EPS (Events per second). The host has 1000 EPS allocated but the occasional spikes (Events per second). The host has 1000 EPS allocated but the occasional spikes go up to 1185 EPS. go up to 1185 EPS. What happens with the events when they go over the allocated amount? What happens with the events when they go over the allocated amount? A. Events are shown normally, but no offenses are generated. A. Events are shown normally, but no offenses are generated. B. Events are moved to a temporary queue. B. Events are moved to a temporary queue. C. Events are shown normally, QRadar has 20% buffer. C. Events are shown normally, QRadar has 20% buffer. D. Events are dropped. D. Events are dropped. Answer: B Answer: B

9. Question 8 Question 8 High availability (HA) has been configured for an event processor in a deployment. The end user gets High availability (HA) has been configured for an event processor in a deployment. The end user gets the notification "Disk Usage Exceeded max Threshold" for the /store partition on primary host. The the notification "Disk Usage Exceeded max Threshold" for the /store partition on primary host. The retention settings are "Delete data in this bucket: immediately after the retention period has expired". retention settings are "Delete data in this bucket: immediately after the retention period has expired". What will be the behavior of the primary at this stage? What will be the behavior of the primary at this stage? A. Primary will stop HA disk replication and failover to Secondary A. Primary will stop HA disk replication and failover to Secondary B. Primary will keep running HA disk replication and failover to Secondary B. Primary will keep running HA disk replication and failover to Secondary C. Primary will stop HA disk replication and No failover to Secondary C. Primary will stop HA disk replication and No failover to Secondary D. Primary will keep running HA disk replication and No failover to Secondary D. Primary will keep running HA disk replication and No failover to Secondary Answer: A Answer: A

10. Question 9 Question 9 A deployment professional needs to configure the X-Force Threat Intelligence Feed through a web A deployment professional needs to configure the X-Force Threat Intelligence Feed through a web proxy to access the cloud servers hosting the information. proxy to access the cloud servers hosting the information. How should the deployment professional configure the proxy for this access? How should the deployment professional configure the proxy for this access? A. Edit the Vetc/httpd/conf.d/ssl.conf and Vopt/qradar/dca/server.ini' files on the Console and A. Edit the Vetc/httpd/conf.d/ssl.conf and Vopt/qradar/dca/server.ini' files on the Console and restart some services restart some services B. Reconfigure iptables access on each managed host to provide access to 'update.xforce- B. Reconfigure iptables access on each managed host to provide access to 'update.xforce- security.com' and 'license.xforce-security.com' and restart some services security.com' and 'license.xforce-security.com' and restart some services C. Complete the 'Server Config' values in the Advanced Update Configuration section of Auto C. Complete the 'Server Config' values in the Advanced Update Configuration section of Auto Updates ) Updates ) D. Complete the 'System Proxy' values in the Advanced System Settings section of the Admin tab D. Complete the 'System Proxy' values in the Advanced System Settings section of the Admin tab Answer: D Answer: D

11. Question 10 Question 10 A deployment professional is working on integrating an unsupported log source. The log source is A deployment professional is working on integrating an unsupported log source. The log source is able to send events in multiple formats. The administrators of the log source ask which event format able to send events in multiple formats. The administrators of the log source ask which event format should be configured. should be configured. Which event format should the deployment professional choose to be able to use direct parsing Which event format should the deployment professional choose to be able to use direct parsing support in QRadar's DSM editor? support in QRadar's DSM editor? A. BLOB A. BLOB B. Regex B. Regex C. LEEF C. LEEF D. SAML D. SAML Answer: A Answer: A