Download IBM.C1000-026.TestKing.2019-12-04.29q.tqb
| Vendor: | IBM |
| Exam Code: | C1000-026 |
| Exam Name: | IBM Security QRadar SIEM V7.3.2 Fundamental Administration |
| Date: | Dec 04, 2019 |
| File Size: | 119 KB |
Demo Questions
Question 1
Which event routing rule is required to add QRadar Data Store (QDS) capability to a deployment?
- Log Only (exclude Analytics)
- Delete data When storage space is required
- Bypass Correlation
- Delete data immediately after the retention period has expired
Correct answer: A
Explanation:
Reference: https://www.ibm.com/support/knowledgecenter/en/SS42VS_7.3.2/com.ibm.qradar.doc/t_qradar_adm_data_store.html Reference: https://www.ibm.com/support/knowledgecenter/en/SS42VS_7.3.2/com.ibm.qradar.doc/t_qradar_adm_data_store.html
Question 2
An administrator is seeing the following system notification:
38750057 – A protocol source configuration may be stopping events from being collected.
What is a valid user action to this issue?
- Re-install the QRadar Console
- Review the /var/log/qradar.log file for more information
- Restart the QRadar Console
- Review the /var/log/error.log file for more information
Correct answer: D
Explanation:
Reference: https://www.ibm.com/support/knowledgecenter/en/SS42VS_7.3.0/com.ibm.qradar.doc/38750057.html Reference: https://www.ibm.com/support/knowledgecenter/en/SS42VS_7.3.0/com.ibm.qradar.doc/38750057.html
Question 3
An administrator is about to integrate logs from a custom firewall in a QRadar deployment using syslog. The SIEM has two domains, namely Domain A and Domain B. While reviewing the following sample logs, the administrator notices a “context” keyword:
May 14 11:05:01 192.168.1.23 20190514 11:05:00 context=contextA permit 192.168.1.24 source: 10.10.1.15; source_port: 64094; destination: 10.10.13.34; service: 53; protocol: udp;
May 13 12:07:01 192.168.1.23 20190513 11:07:00 context=contextB permit 192.168.1.25 source: 10.10.1.15; source_port: 64094; destination: 10.10.13.34; service: 53; protocol: udp;
Which options assign the “contextA” logs to DomainA and the “contextB” logs to domain B? (Choose two.)
- Create a single log source, create a “Context” custom event property, and assign the log to both domains using a custom rule.
- Create two individual log sources by configuring a separated logging instance for each context on the firewall and assign each log source to the correct domain.
- Create a single log source, create a “Context” custom event property, and assign the log to the correct domain using custom event property value.
- Create two individual log sources using the context value as log source identifier and assign each log source to the correct domain.
- Create a single log source, create a “Context” custom event property, and assign the log to the correct domain using a custom rule.
Correct answer: BD
