Latest [Aug 29, 2021] C1000-018 Exam with Accurate IBM QRadar SIEM V7.3.2 Fundamental Analysis PDF Questions
Take a Leap Forward in Your Career by Earning IBM 62 Questions
NEW QUESTION 35
While creating a new custom property, which is a valid property types selection?
- A. Flow Based
- B. Event Based
- C. AQL Based
- D. Regular Expressions Based
Answer: D
Explanation:
Explanation
https://www.ibm.com/docs/en/qsip/7.4?topic=qradar-custom-property-definitions-in-dsm-editor
NEW QUESTION 36
An analyst is investigating access to sensitive data on a Linux system. Data is accessible from the /secret directory and can be viewed using the 'sudo oaf command. The specific file /secret/file_08-txt was known to be accessed in this way. After searching in the Log Activity Tab, the following results are shown.
When interpreting this, the analyst is having trouble locating events which show when the file was accessed.
Why could this be?
- A. The 'LinuxServer @ cantos' log source has boon configured as a Faise Positive and the specific event for that file has been dropped.
- B. The 'LinuxServer @ centos' log source has coalescing configured and the specific event for that file can only be accessed by clicking on the 'Event Count' value.
- C. The 'LinuxServer @ centos' log source has not been configured to send the relevant events to QRadar.
- D. The ;LinuxServer @ centos; log source has coalesscing conigured and the specific event for that file has been discardedd.
Answer: B
NEW QUESTION 37
An analyst has been assigned a number of Offenses to review and a new event occurs. review and manage.
While reviewing an inactive offense, a new event occurs.
Which statement applies to the Offense?
- A. The event is added in a new Offense that is created.
- B. The event is added to the Offense and the status is changed to Dormant.
- C. The rule that created the Offense is temporarily halted.
- D. The event is added to the Offense and the status is changed to Active.
Answer: B
NEW QUESTION 38
What does the Assets tab provide?
A unified view of the information that is kwon about:
- A. triggered Offenses.
- B. log sources.
- C. events and flows.
- D. network devices.
Answer: C
NEW QUESTION 39
An analyst working with QRadar SIEM has been assigned a new Offense and is preparing a custom report on the Offense summary page. From this page, the analyst wants to navigate to the Log Activity or Network Activity page to export the Event/Flow data (Action -> export to CSV).
How can the analyst do this? (Choose two)
- A. In the Source IP(s) session, click the link to open the page.
- B. Click the View Attack Path icon.
- C. In the Event/Flow count section, click the link to open the page.
- D. Click the Summary icon.
- E. Click the Events / Flows icon.
Answer: A,C
NEW QUESTION 40
Which QRadar timestamp specifies when the event was received from the log source?
- A. Storage time
- B. Log Source time
- C. Start time
- D. Collect time
Answer: C
Explanation:
Explanation
https://www.ibm.com/mysupport/s/question/0D50z00006PEG2mCAH/why-do-i-see-different-time-stamps-for-q
NEW QUESTION 41
A new analyst is tasked to identify potential false positive Offenses, then send details of those Offenses to the Security Operations Center (SOC) manager for review by using the send email notification feature.
- A. Total number of sources, top five sources by magnitude, total number of destinations, destination networks, total number of events.
- B. Total number of sources, top five sources by magnitude, total number of destinations, destination networks, total number of packets.
- C. Total number of sources, top five number of categories, total number of destinations, destination networks, total number of packets.
- D. Total number of sources, top five categories, total number of destinations. Contributing CRE rules total number of packets.
Answer: C
NEW QUESTION 42
QRadar collects information from numerous log sources and other agents. Sometimes these agents stop reporting to QRadar for a variety of reasons. There is a default rule in QRadar to help identify these cases called the Device Stopped Sending Events (DSSE) Rule.
What does the DSSE Rule do?
- A. It listens for log sources that send out regular health events and triggers the Rule when encountered
- B. It checks for Rules which have fired due to an absence of Events.
- C. It runs when there is an absence of Events.
- D. It checks for log sources which are reporting that they have not had any communication in a certain amount of time.
Answer: D
NEW QUESTION 43
An analyst needs to find all events that are creating offenses that are triggered by rules that contain the word suspicious in the rule name.
Which query can the analyst use as a working sample?
- A. SELECT LOGGEDOFFENSE(logsourceid), * from offense_events where RULENAME(creeventlist) ILIKE ,%suspicious%'
- B. SELECT LOGSOURCERULES(logsourceid), " from rule_events where RULENAME(creeventlist) ILIKE '%suspicious%'
- C. SELECT LOGSOURCETYPE(logsourceid), - from log_events where RULENAME(creeventlist) ILIKE '%suspicious%'
- D. SELECT LOGSOURCENAME(logsourceid), * from events where RULENAME(creeventlist) ILIKE
,o/0suspicious%'
Answer: D
NEW QUESTION 44
An analyst is searching for a list of events that meet specific search criteria and wants to display only the source IP and destination IP information for the events.
To get the required information, the analyst can open the Log Activity tab and then:
- A. select the field names,
select the start and end time from the drop down fields in the filters section, then click search. - B. click add filter,
select the desired parameters, operators, values and field names,
then click search. - C. select search,
then new search,
scroll down and select time range, column definitions, the search parameters then click search. - D. select advanced search.
type the corresponding AQL query,
then click search.
Answer: A
NEW QUESTION 45
An analyst needs to review additional information about the Offense top contributors, including notes and annotations that are collected about the Offense.
Where can the analyst review this information?
- A. In the bottom portion of the Offense main view
- B. In the top portion of the Offense Summary window
- C. In the top portion of the Offense main view
- D. In the bottom portion of the Offense Summary window
Answer: A
NEW QUESTION 46
An analyst is performing an investigation regarding an Offense. The analyst is uncertain to whom some of the external destination IP addresses in List of Events are registered.
How can the analyst verify to whom the IP addresses are registered?
- A. Right-click on the destination address, More Options, then Information, and then DNS Lookup
- B. Right-click on the destination address, More Options, then IP Owner
- C. Right-click on the destination address, More Options, then Information, and then WHOIS Lookup
- D. Right-click on the destination address, More Options, then Navigate, and then Destination Summary
Answer: D
NEW QUESTION 47
How can an analyst verify if any host in the deployment is vulnerable to CVE ID; CVE-2010-000?
- A. Use the asset search feature, select vulnerability external reference from the list of search parameters, select CVE and then type: $CVE-2010000
- B. Use the asset search feature, select vulnerability external reference from the list of search parameters, select CVE and then type: $2010-000
- C. Use the asset search feature, select vulnerability external reference from the list of search parameters, select CVE and then type: CVE-2010000
- D. Use the asset search feature, select vulnerability external reference from the list of search parameters, select CVE and then type: 2010-000
Answer: A
NEW QUESTION 48
An analyst is working on Offense management and finds that a few of the offenses are not being removed from the Offense tab even after the Offense retention period has elapsed.
What could be the reason that these offenses are not being removed?
- A. Offense is released
- B. Offense is protected
- C. Offense is inactive
- D. Offense has been annotated
Answer: B
Explanation:
Explanation
https://www.ibm.com/docs/en/qsip/7.4?topic=management-offense-retention
NEW QUESTION 49
An analyst for a particular offense needs to investigate to understand the breakdown of the offense details.
How can the analyst do this?
- A. View the attack path of the offense.
- B. Look at the magnitude information and its breakdown.
- C. Look at all the event QIDs attached to the offense.
- D. Look at the list of categories, event low level categories and the events attached.
Answer: D
NEW QUESTION 50
......
Authentic Best resources for C1000-018 Online Practice Exam: https://www.topexamcollection.com/C1000-018-vce-collection.html
