C1000-018無料問題集「IBM QRadar SIEM V7.3.2 Fundamental Analysis」

質問 1

An analyst needs to create a dashboard item that can be shared with other users. What is the main step in this process?

（A）Ask the administrator to modify the shared search criteria and test the dashboard.

（B）Enable a new custom dashboard and share it with users.

（C）Have users index the shared search criteria for reuse.

（D）Create and share the search criteria that the dashboard Item will use.

正解：B 解答を投票する

質問 2

Which statement about False Positive Building Blocks applies?
Using False Positive Building Blocks:

（A）helps to prevent unwanted alerts, but there is no effect on performance.

（B）helps to prevent unwanted alerts, and reduces the performance impact of testing rules that do not need to be tested.

（C）has no impact on unwanted alerts, or performance.

（D）has no impact on unwanted alerts, but it does reduce the performance impact of testing rules that do not need to be tested.

正解：A 解答を投票する

質問 3

An analyst needs to create a new custom dashboard to view dashboard items that meet a particular requirement.
What are the main steps in the process?

（A）Select New Dashboard and enter unique name, description, add items and save.

（B）Select New Dashboard and copy name, add description, items and save.

（C）Locate existing dashboard and modify to include indexed items required and save.

（D）Request the administrator to create the custom dashboard with required items.

正解：D 解答を投票する

解説: (JPNTest メンバーにのみ表示されます)

質問 4

An analyst needs to review additional information about the Offense top contributors, including notes and annotations that are collected about the Offense.
Where can the analyst review this information?

（A）In the top portion of the Offense Summary window

（B）In the bottom portion of the Offense main view

（C）In the bottom portion of the Offense Summary window

（D）In the top portion of the Offense main view

正解：C 解答を投票する

解説: (JPNTest メンバーにのみ表示されます)

質問 5

An analyst is investigating a user's activities and sees that they have repeatedly executed an action which triggers a rule that emails the SOC team and creates an Offense, indexed on Username.
The SOC team complained that they have received 15 emails in the space of 10 minutes, but the analyst can only see one Offense in the Offenses tab.
How is this explained?

（A）The Custom Rules Engine (CRE) has fallen behind and the additional Offenses will be created shortly.

（B）An Offense rule has been configured to send multiple emails upon Offense creation.

（C）This is expected behavior, the offense will contain the information about all 15 events.

（D）There is a Rule Limiter on the Rule Action which creates the Offense, this should also be applied to the Rule Responses.

正解：B 解答を投票する

質問 6

An analyst needs to map a geographic location on all the internal IP addresses.
Which option defines the functions where the analyst can-setup a geographic location of the network object in Network Hierarchy?

（A）GPS location and Map

（B）Group and IP address

（C）Log Activity and Network Activity

（D）Longitude and Latitude

正解：B 解答を投票する

質問 7

While creating a new custom property, which is a valid property types selection?

（A）Flow Based

（B）Event Based

（C）AQL Based

（D）Regular Expressions Based

正解：D 解答を投票する

質問 8

How does an analyst view which rule triggered an Offense in the Offense summary page?

（A）Display -> Triggered Rules

（B）Actions -> View Rules

（C）Display -> Rules

（D）Actions -> Display Rules

正解：C 解答を投票する

C1000-018 無料問題集「IBM QRadar SIEM V7.3.2 Fundamental Analysis」

弊社を連絡する

関連リンク

トップ試験