C1000-055無料問題集「IBM QRadar SIEM V7.3.2 Deployment」

質問 1

During a new deployment, the client states that they want to collect windows logs and forward them to QRadar, but they are already using another agent to collect logs for a managed service provider [MSP] The client would like to continue forwarding these logs to the MSP as well as send them to QRadar.
Which architectural solutions would meet the client's requirements?

（A）Configure windows MSRPC protocol to send events to both.

（B）Install an unmanaged Wincollect instance and a setup multiple forwarding destinations to the Wincollect configuration server.

（C）Install a managed Wincollect instances and setup multiple forwarding destinations.

（D）Configure Windows Event Forwarding to send events to both destinations.

正解：A 解答を投票する

質問 2

A customer needs to increase the storage space that is available to an Event Processor and be able to speed up historical searches.
Which solution should the deployment professional recommend?

（A）Expand the storage space on the Event Processor using LVM

（B）Connect a Data Node to the Event Processor

（C）Connect additional External Storage to the Event Processor

（D）Add an Event Collector to the Event Processor

正解：A 解答を投票する

質問 3

The iSCSI offboard storage is being configured. Which sequence should be used?

（A）Stop services on QRadar > Mount iSCSI file system > Migrate the data to iSCSI > Configure iSCSI

（B）Stop services on QRadar > Configure iSCSI > Mount iSCSI file system /store > Migrate the data to iSCSI

（C）Configure iSCSI > Stop services on QRadar > Migrate the data to iSCSI > Mount iSCSI file system

（D）Stop services on QRadar > Migrate the data to iSCSI > Configure iSCSI > Mount iSCSI file system

正解：C 解答を投票する

質問 4

What are anomaly detection rules used for?

（A）Detecting event traffic.

（B）Detecting volume changes that occur in regular patterns.

（C）Detecting an activity that is greater or less than a specified range.

（D）Detecting when unusual traffic patterns occur in the network.

正解：B 解答を投票する

質問 5

A deployment professional needs to configure the IBM QRadar systems so that data is forwarded to one or more vendor systems, such as ticketing or alerting systems.
Which event format options can the deployment professional use for forwarding destination configuration?

（A）normalized, json and cef

（B）json, cef and payload

（C）payioad, normalized and json

（D）leef, json and cef

正解：A 解答を投票する

質問 6

A deployment professional needs to check which rules cause events to be dropped on the Console with Pipeline NATIVE_To_MPC messages.
Which script would help with this task?

（A）/opt/qradar/support/findRules.sh

（B）/opt/qradar/support/findExpensiveCustomProperties.sh

（C）/opt/qradar/support/findExpensiveCustomRules.sh

（D）/opt/qradar/support/astat.sh

正解：D 解答を投票する

質問 7

A deployment professional needs to ensure that in high-security unidirectional networks (also known as data diodes), logs are collected from different log sources.
Which option should the deployment professional use?

（A）A Disconnected Log Collector of IBM QRadar

（B）An IBM QRadar Event Processor

（C）An IBM QRadar Data Node

（D）An IBM QRadar Packet Capture solution

正解：D 解答を投票する

C1000-055 無料問題集「IBM QRadar SIEM V7.3.2 Deployment」

弊社を連絡する

関連リンク

トップ試験