Latest Dumps Questions for IBM Certification C1000-018 Exam

dumps2021-11-02T02:41:03+08:00

IBM Certification C1000-018 exam is a requried test for IBM Certified Associate Analyst-IBM QRadar SIEM V7.3.2 certification. There are 60 questions in real IBM C1000-018 exam, and you have 90 minutes to complete all the questions. The number of questions required to pass is 38. The test languages are English and Japanese. Free IBM C1000-018 exam dumps questions are available blow.

Page 1 of 4

1. What is the reason for this system notification?

"Time synchronization to primary or Console has failed"

Deny ntpdate communication on port 423.

Deny ntpdate communication on port 223.

Deny ntpdate communication on port 323.

Deny ntpdate communication on port 123

2. What is displayed in the status bar of the Log Activity tab when streaming events?

Average number of results that are received per second.

Average number of results that are received per minute.

Accumulated number of results that are received per second.

Accumulated number of results that are received per minute.

3. An analyst has created a custom property from the events for searching for critical information. The analyst also needs to reduce the number of event logs and data volume that is searched when looking for the critical information to maintain the efficiency and performance of QRadar.

Which feature should the analyst use?

Index Management

Log Management

Database Management

Event Management

4. Which are the supported protocol configurations for Check Point integration with QRadar? (Choose two.)

CHECKPOINT REST API

SYSLOG

JDBC

SFTP

OPSEC/LEA

5. How would an analyst Interpret this QRadar notification: "SAR Sentinel: threshold crossed?"

The system disk usage is above the threshold and must be reduced to avoid potential data loss.

The system load is above the threshold and can experience reduced performance.

The anomaly detection engine has detected volume of failed logins above the threshold.

The Custom Rule Engine is currently detecting a distributed denial of service attack.

6. An analyst is performing an investigation regarding an Offense. The analyst is uncertain to whom some of the external destination IP addresses in List of Events are registered.

How can the analyst verify to whom the IP addresses are registered?

Right-click on the destination address, More Options, then Information, and then DNS Lookup

Right-click on the destination address, More Options, then IP Owner

Right-click on the destination address, More Options, then Information, and then WHOIS Lookup

Right-click on the destination address, More Options, then Navigate, and then Destination Summary

7. An analyst wants to find all events where Process name includes reference to exe files.

Which quick search will return the expected result?

(Process name) AND /.*exe/

/Process name/AND (/exe) )

/Process name/ AND /.*exe/

"Process name" AND "*exe"

8. An analyst needs to review additional information about the Offense top contributors, including notes and annotations that are collected about the Offense.

Where can the analyst review this information?

In the top portion of the Offense main view

In the bottom portion of the Offense main view

In the top portion of the Offense Summary window

In the bottom portion of the Offense Summary window

9. The administrator had set up several scheduled reports that can be executed by analysts every Monday, and the first day of each month. On Thursday, an executive requests one of the weekly reports.

If the analyst executes the report on Thursday, what information will the report contain?

Data from Thursday from the previous week to Wednesday from the current week

Data from Monday to Wednesday from the current week.

Data from Monday to Thursday from the current week.

Data from Monday to Sunday from the previous week.

10. An analyst has to perform an export of events within a timeframe, but not all the columns are present in the log view for the time period the analyst has selected. The analyst only needs specific columns exported for an external analysis.

How can the analyst accomplish this task?

Edit the search and select the extra columns, then export the result with Action/Export to XML/Full Export. This export is only supported in XM

Edit the search and select the extra columns, then export the result with Action/Export to XML/Visible Columns. This export is only supported in XM

Edit the search result and select the extra columns, then export the result with Action/Export to CSV/Full Export.

Edit the search result and select the extra columns, then export the result with Action/Export to CSV/Visible Columns.

Page 2 of 4

11. An analyst is encountering a large number of false positive results. Legitimate internal network traffic contains valid flows and events which are making it difficult to identify true security incidents.

What can the analyst do to reduce these false positive indicators?

Create X-Force rules to detect false positive events.

Create an anomaly rule to detect false positives and suppress the event.

Filter the network traffic to receive only security related events.

Modify rules and/or Building Block to suppress false positive activity.

12. From which tab in QRadar SIEM can an analyst search vulnerability data and remediate vulnerabilities?

Log Activity

Admin

Dashboard

Assets

13. How does the Custom Rule Engine (CRE) evaluates rules?

It runs stateless tests first, then runs stateful tests and evaluates the result.

It runs tests based on the criticality of the test, running the critical ones first.

It runs rule tests line-by-line in order, and continues while tests are true.

It runs all rule tests at the same time, and evaluates the result after all tests are complete

14. What are anomaly detection rules used for?

Detecting volume changes that occur in regular patterns.

Detecting event traffic.

Detecting an activity that is greater or less than a specified range.

Detecting when unusual traffic patterns occur in the network.

15. An analyst needs to perform a Quick search to find events under the Log Activity tab that contains an ‘exe’ file during a certain time period.

How can the analyst do this?

On the Search bar select Quick Filter, then insert filter criteria for ‘/*.exe/’ and then select a time interval from the view option’s drop down.

Select Search C New Search from the menu bar, then select all the search criteria required from the UI options provided.

Select Quick Searches on the menu bar, then go through the list of saved searches available to see if one already exists, that can be altered.

On the Search bar select Quick Filter, insert: ‘exe, last 1 hour’ into the filter criteria, then click Search.

16. Which QRadar component stores Event data?

App Host

Event Collector

Event Processor

Flow Collector

17. While creating a new custom property, which is a valid property types selection?

AQL Based

Regular Expressions Based

Flow Based

Event Based

18. Which component in QRadar collects and creates flow information?

sflow

NetFIow

Qflow

J-Flow

19. How would an analyst efficiently include all the Antivirus logs integrated with QRadar for the last 24 hours?

Log Activity -> Use Log Source parameter with Equals Operator

Log Activity -> Use Log Source Type parameter with Member of Operator

Log Activity -> Use Log Source parameter with Equals any of Operator

Log Activity -> Use Log Source Type parameter with Equals any of Operator

20. An analyst wants to create a report using the report wizard.

What are key elements used by the wizard to create the report?

Report templates, layout, content.

Report templates, layout, saved searches

Layout, container, content

Report templates, user groups, permissions.

Page 3 of 4

21. An analyst needs to find all events that are creating offenses that are triggered by rules that contain the word suspicious in the rule name.

Which query can the analyst use as a working sample?

SELECT LOGSOURCENAME(logsourceid), * from events where RULENAME(creeventlist) ILIKE ‘%suspicious%’

SELECT LOGGEDOFFENSE(logsourceid), * from offense_events where RULENAME(creeventlist) ILIKE ,%suspicious%'

SELECT LOGSOURCETYPE(logsourceid), - from log_events where RULENAME(creeventlist) ILIKE '%suspicious%'

SELECT LOGSOURCERULES(logsourceid), " from rule_events where RULENAME(creeventlist) ILIKE '%suspicious%'

22. What does the Assets tab provide?

A unified view of the information that is kwon about:

events and flows.

triggered Offenses.

log sources.

network devices.

23. An analyst is searching for a list of events that meet specific search criteria and wants to display only the source IP and destination IP information for the events.

To get the required information, the analyst can open the Log Activity tab and then:

select the field names, select the start and end time from the drop down fields in the filters section, then click search.

click add filter, select the desired parameters, operators, values and field names, then click search.

select advanced search , type the corresponding AQL query, then click search.

select search, then new search, scroll down and select time range, column definitions, the search parameters then click search.

24. There are 5 authentication servers that report to different Event Processors. There is a requirement to generate an Offense if there are 5 consecutive failed logins detected across any of the 5 Event Processors.

Which type of rule should the analyst create?

Global Rule

Persistent Rule

Local Rule

Offense Rule

25. What could be a reason that an Event Rule is not triggering as expected?

It contains stateful tests but is configured to use a Processors CRE Instance instead of the Consoles CRE Instance.

It contains stateless tests but is configured to use the Console's CRE Instance instead of the Processor's CRE Instance.

It contains stateful and stateless tests but is configured to use a Console's CRE Instance instead of the Processor s CRE Instance.

It contains stateless tests but is configured to use the Processors CRE Instance instead of the Console's CRE Instance.

26. An analyst needs to create a new custom dashboard to view dashboard items that meet a particular requirement.

What are the main steps in the process?

Select New Dashboard and enter unique name, description, add items and save.

Select New Dashboard and copy name, add description, items and save.

Request the administrator to create the custom dashboard with required items.

Locate existing dashboard and modify to include indexed items required and save.

27. An analyst is working on Offense management and finds that a few of the offenses are not being removed from the Offense tab even after the Offense retention period has elapsed.

What could be the reason that these offenses are not being removed?

Offense has been annotated

Offense is inactive

Offense is released

Offense is protected

28. When looking at Common rules, the parameters available to the tests refer to attributes of events and flows.

Which attributes are available?

Common rule tests can operate on:

all flow attributes, but no event attributes.

all attributes of events and flows.

all event attributes, but no flow attributes.

a subset of the attributes of events and flows.

29. What is a valid offense naming mechanism?

This information should:

set the naming of the associated offense(s).

set or replace the naming of the associated offense(s).

replace the naming of the associated offense(s).

be included in the naming of the associated offense(s).

30. What is the procedure to re-open a closed Offense?

A closed Offense cannot be re-opened.

Wait for new events/flows that will re-open the closed Offense.

Activate the Offense in the action/re-open drop down menu of the Offense tab.

Activate the Offense in action/re-open drop down menu in the Admin tab.

Page 4 of 4

31. When an Offense is triggered, it only shows the events that triggered the Offense. The analyst wants to investigate further to see more events around the incident, not only those that triggered the Offense. The analyst clicks on the event count and sees the events belonging to the Offense.

How can the analyst processed to see a more detailed picture of what occurred?

Right-click on the destination IP, and choose More Options, then Raw Events.

Right-click on the source IP, and choose More Options, then Information, and then Search Events

Right-click and filter on the Destination I

Right-click on the source IP, and choose View in DSM Editor.

Latest Dumps Questions for IBM Certification C1000-018 Exam

Latest Dumps Questions for IBM Certification C1000-018 Exam

Share this post

Leave a Reply Cancel reply

Related Posts