Free IBM C1000-163 Exam Dumps Questions & Answers

A security analyst uses Use Case Manager > Active Rules and detects which TOP rule-generating offenses are triggered due to inbound traffic that is dropped by the firewall. The company decides that the rule should only trigger only when there are firewall permit events.
Which of these does the analyst implement to meet the above requirement?

• A.Open Rule Wizard add a test condition > and when the event category for the event is one of the following Access.Misc Application Action Denied
• B.Open Rule Wizard add a test condition > and when the context is Local to Local, Local to Remote
• C.Open Rule Wizard add a test condition > and NOT when an event matches any of the following BB:CategoryDefinition: Firewall or ACL Accept
• D.Open Rule Wizard add a test condition > and when an event matches any of the following BB:CategoryDefinition: Firewall or ACL Accept

For a Source IP based offense, which field helps determine relative importance of the targets to the business?

• A.Last Event/Flow
• B.Duration of the offense
• C.Relative importance of Destination IP(s)
• D.Total number of Events

Which service is responsible for adding new assets in Qradar?

• A.Asset Profiler
• B.ecs-ep
• C.ecs-ec
• D.Vulnerability Information Server

A QRadar deployment professional designs a multi-tenant environment where each tenant is permitted a quantity of events per second (EPS).
In a discussion with the service provider (who provides the security monitoring services to each tenant), how should the deployment professional describe the licensing options available?

• A.Per-tenant EPS limits can be set, but any events over the EPS will be dropped from the pipeline; over- license buffering will not be used to handle EPS spikes.
• B.Per-tenant EPS limits can be set if the tenants are defined by event collectors. Then over-license buffering can be used to handle EPS spikes.
• C.The domain sets EPS limits, so each tenant needs to have only one domain. This way, over-license buffering can be used to handle EPS spikes.
• D.If each domain and tenant is defined by log source groups, the EPS limit can be shared by the log source groups used for each tenant. Over-license buffering is defined at the event collector.

What is a difference between a flow and an event?

• A.A flow occurs at a moment in time while events have a duration from a log source.
• B.A flow is a record from a log source, such as a firewall or router device, that describes an action on a network. An event analysis provides visibility into layer 7 for applications such as web browsers, NFS, SNMP, Telnet, and FTP.
• C.An event occur at a moment in time while flows have a duration from the flow source.
• D.An event is a record from a log source, such as a firewall or router device, that describes an action on a network. A flow record provides visibility into layer 7 for applications such as web browsers, NFS, SNMP, Telnet, and FTP.