Oct 10, 2021 Step by Step Guide to Prepare for C1000-026 Exam BrainDumps
IBM Security C1000-026 Real Exam Questions and Answers FREE Updated on 2021
NEW QUESTION 36
How many default dashboards does QRadar have?
- A. 0
- B. 1
- C. 2
- D. 3
Answer: D
Explanation:
Reference:
c_qradar_customize_dboard.html
NEW QUESTION 37
Which log should be reviewed to determine the reasons a patch installer did not proceed during a QRadar upgrade?
- A. /var/log/qradar.audit
- B. /var/log/setup-*/patches.log
- C. /var/log/qradar.log
- D. /var/log/upgrade.log
Answer: B
Explanation:
Reference:
https://www.ibm.com/support/pages/qradar-unable-run-patch-installer-and-update-exits-screenterminating- message
NEW QUESTION 38
An administrator needs to develop advanced filters to retrieve information from the QRadar System pertaining to the top abnormal events of the most bandwidth-intensive IP addresses.
How can the administrator do this?
- A. Use the IBM DataStudio to create the query
- B. Build an AQL query using the QRadar Scratchpad
- C. Combine GROUP BY and ORDER BY clauses in a single query
- D. Build an AQL query using the QRadar GUI using Assets > Search Filter
Answer: C
Explanation:
Reference:
https://www.ibm.com/support/knowledgecenter/SS42VS_7.3.1/com.ibm.qradar.doc/ b_qradar_aql.pdf (21)
NEW QUESTION 39
An administrator would like to categorize discovered assets by port definitions and add this information to a server type building block for further use.
Which QRadar Console functionality should the administrator use?
- A. Admin Tab - Auto Update
- B. Assets Tab - Server Discovery
- C. Admin - Scheduled Scans
- D. Assets Tab - Actions - Scan
Answer: B
Explanation:
Explanation/Reference: https://www.ibm.com/support/knowledgecenter/SS42VS_7.3.1/com.ibm.qradar.doc/ b_qradar_tuning_guide.pdf
NEW QUESTION 40
How many default dashboards does QRadar have?
- A. 0
- B. 1
- C. 2
- D. 3
Answer: D
Explanation:
Explanation/Reference: https://www.ibm.com/support/knowledgecenter/SS42VS_7.3.0/com.ibm.qradar.doc/ c_qradar_customize_dboard.html
NEW QUESTION 41
An administrator needs data backup.
What information is contained in the data backup?
- A. Audit log information, Event data, Flow data, Report data, Indexes, Log sources
- B. Audit log information, Event data, Flow data, Report data, Indexes
- C. Audit log information, Event data, Indexes, Index management information, Flow data, Report data, Groups
- D. Audit log information, Event data, Indexes, Index management information, Flow data, Report data
Answer: B
Explanation:
Reference:
https://www.ibm.com/support/knowledgecenter/en/SS42VS_7.3.0/com.ibm.qradar.doc/ c_qradar_adm_man_back_recovery.html
NEW QUESTION 42
An administrator is seeing the following system notification:
38750057 - A protocol source configuration may be stopping events from being collected.
What is a valid user action to this issue?
- A. Restart the QRadar Console
- B. Re-install the QRadar Console
- C. Review the /var/log/qradar.log file for more information
- D. Review the /var/log/error.log file for more information
Answer: D
Explanation:
Reference:
https://www.ibm.com/support/knowledgecenter/en/SS42VS_7.3.0/
com.ibm.qradar.doc/38750057.html
NEW QUESTION 43
An administrator is tasked to reduce data volumes in the asset database and reduce stale data contributing to asset growth deviation.
How can the administrator tune the configuration of the Asset Profiler?
- A. In the System Configuration section of the Admin, access the Asset Profile Configuration and reduce the retention values for the Asset Profiler Retention Configuration and Save. Next, deploy the changes into the environment for the updates to take effect.
- B. On the navigation menu, click Admin, click the Asset Profile Configuration and reduce the retention values for the Asset Profiler Retention Configuration and Save. On the navigation menu, click Admin and from the Advanced menu, click Restart Event Collection Services. Next, deploy the changes into the environment for the updates to take effect.
- C. In the System Configuration section of the Admin, access the Asset Profile Configuration and increase the retention values for the Asset Profiler Retention Configuration and Save. Next, deploy the changes into the environment for the updates to take effect.
- D. In the System Configuration section of the Admin, access the Asset Profile Configuration and increase the retention values for the Asset Profiler Retention Configuration and Save. On the navigation menu, click Admin and from the Advanced menu, click Restart Event Collection Services. Next, deploy the changes into the environment for the updates to take effect.
Answer: C
Explanation:
Reference:
t_qradar_adm_asset_tuning_ip_retention.html
NEW QUESTION 44
An administrator has added a new Event Processor to a QRadar deployment.
How many events per second (EPS) are granted from the temporary license and how many days will those EPS last?
- A. 5000 EPS for a 35 day period
- B. 10000 EPS for a 35 day period
- C. 5000 EPS for a 45 day period
- D. 10000 EPS for a 45 day period
Answer: A
Explanation:
Explanation/Reference: https://www.ibm.com/support/knowledgecenter/en/SS42VS_7.3.0/com.ibm.qradar.doc/ c_qradar_adm_license_mgmt.html
NEW QUESTION 45
An administrator enters the QRadar web console into a web browser but does not get a response.
Which process is responsible for the QRadar GUI?
- A. tomcat
- B. consoled
- C. guid
- D. magistrated
Answer: A
Explanation:
Explanation/Reference: https://www.ibm.com/support/pages/qradar-core-services-and-impact-when-restarted
NEW QUESTION 46
What should an administrator do to successfully upgrade an IBM Security QRadar system from an older
- A. Review the release notes and review the architecture.
- B. Verify the upgrade path and update the QRadar apps.
- C. Verify the upgrade path, and review the software, hardware and high availability requirements.
- D. Review the software, hardware and high availability requirements, and consider to update the firmware on
Answer: C
Explanation:
IBM Security QRadar appliances.
Reference:
b_qradar_upgrade.pdf (9)
NEW QUESTION 47
An administrator is about to integrate logs from a custom firewall in a QRadar deployment using syslog. The SIEM has two domains, namely Domain A and Domain
B. While reviewing the following sample logs, the administrator notices a "context" keyword:
May 14 11:05:01 192.168.1.23 20190514 11:05:00 context=contextA permit 192.168.1.24 source: 10.10.1.15; source_port: 64094; destination: 10.10.13.34; service: 53; protocol: udp; May 13 12:07:01 192.168.1.23 20190513 11:07:00 context=contextB permit 192.168.1.25 source: 10.10.1.15; source_port: 64094; destination: 10.10.13.34; service: 53; protocol: udp; Which options assign the "contextA" logs to DomainA and the "contextB" logs to domain B? (Choose two.)
- A. Create a single log source, create a "Context" custom event property, and assign the log to the correct domain using custom event property value.
- B. Create a single log source, create a "Context" custom event property, and assign the log to both domains using a custom rule.
- C. Create two individual log sources by configuring a separated logging instance for each context on the firewall and assign each log source to the correct domain.
- D. Create a single log source, create a "Context" custom event property, and assign the log to the correct domain using a custom rule.
- E. Create two individual log sources using the context value as log source identifier and assign each log source to the correct domain.
Answer: C,E
NEW QUESTION 48
An administrator needs to complete the upgrade process from V7.3.1 to V7.3.2.
What is the correct procedure?
- A. Copy the ISO file extension to the recommended directories and use this file
- B. Do a clean installation using the ISO file on a bootable USB device
- C. Copy the SFS file extension to the recommended directories and use this file
- D. Use the ISO file to execute the upgrade process
Answer: C
Explanation:
Explanation/Reference: https://www.ibm.com/support/knowledgecenter/SS42VS_7.3.2/com.ibm.qradar.doc/ t_qradar_up_ugrad_sys.html
NEW QUESTION 49
An administrator has been tasked to run all health checks at once using the DrQ command before a major event happens, such as an upgrade.
What does the DrQ command do?
- A. It runs all available checks in /opt/ibm/si/diagnostiq and writes the results in a txt file.
- B. It checks all the available drives on the QRadar managed host and writes the results on a txt file.
- C. It shows all the available drives on the QRadar managed host.
- D. It runs all available checks in /opt/ibm/si/diagnostiq with the checkup mode and with the summary output mode.
Answer: D
Explanation:
Reference:
https://www.ibm.com/support/knowledgecenter/en/SS42VS_7.3.2/com.ibm.qradar.doc/ t_drq_running_health_checks.html
NEW QUESTION 50
An administrator installed a new App Host and would like to move the existing applications from the Console to the App Host.
What steps should be performed?
- A. Admin Tab > Extension Management > Move apps
- B. Admin Tab > System Settings > Move apps
- C. Admin Tab > System and License Management > Click to change where apps are run
- D. Admin Tab > Extension Management > Click to change where apps are run
Answer: C
Explanation:
Explanation/Reference:
NEW QUESTION 51
An administrator is about to integrate logs from a custom firewall in a QRadar deployment using syslog. The SIEM has two domains, namely Domain A and Domain B.
While reviewing the following sample logs, the administrator notices a "context" keyword:
May 14 11:05:01 192.168.1.23 20190514 11:05:00 context=contextA permit 192.168.1.24 source:
10.10.1.15; source_port: 64094; destination: 10.10.13.34; service: 53; protocol: udp; May 13 12:07:01 192.168.1.23 20190513 11:07:00 context=contextB permit 192.168.1.25 source:
10.10.1.15; source_port: 64094; destination: 10.10.13.34; service: 53; protocol: udp; Which options assign the "contextA" logs to DomainA and the "contextB" logs to domain B? (Choose two.)
- A. Create a single log source, create a "Context" custom event property, and assign the log to the correct domain using custom event property value.
- B. Create a single log source, create a "Context" custom event property, and assign the log to both domains using a custom rule.
- C. Create two individual log sources by configuring a separated logging instance for each context on the firewall and assign each log source to the correct domain.
- D. Create a single log source, create a "Context" custom event property, and assign the log to the correct domain using a custom rule.
- E. Create two individual log sources using the context value as log source identifier and assign each log source to the correct domain.
Answer: C,E
NEW QUESTION 52
An administrator needs to know if a custom rule is being correlated correctly.
Which QRadar component is responsible for this process?
- A. QRadar Event Processor
- B. Magistrate
- C. QRadar Event Collector
- D. QRadar Console
Answer: A
NEW QUESTION 53
A QRadar upgrade is planned and a maintenance window is scheduled. The administrator must stage the FIXPACK from IBM Fix Central.
Which QRadar FIXPACK file type must the administrator download?
- A. RPM
- B. XFS
- C. SFS
- D. IMG
Answer: C
Explanation:
Explanation/Reference: https://www-945.ibm.com/support/fixcentral/swg/selectFixes?parent=IBM%
20Security&product=ibm/Other+software/IBM+QRadar+Network
+Insights&release=7.3.0&platform=Linux&function=all
NEW QUESTION 54
An administrator has to change the system hardware clock of the QRadar server. The administrator has already restarted the main services (hostservices, tomcat, hostcontext) and needs to synchronize the QRadar Console time with the QRadar managed hosts.
Which command can the administrator use to accomplish this?
- A. /sbin/hwclock -systohc /opt/qradar/bin/time_sync.sh
- B. /opt/qradar/support/all_servers.sh systemctl restart systemd-timedated.service
- C. /opt/qradar/support/all_servers.sh /opt/qradar/bin/time_sync.sh
- D. /opt/qradar/support/all_servers.sh service ntpd restart
Answer: C
Explanation:
Explanation/Reference: https://www.ibm.com/support/pages/qradar-configuring-ntp-settings-qradar-appliance
NEW QUESTION 55
......
Ultimate Guide to Prepare C1000-026 Certification Exam for IBM Security: https://www.practicedump.com/C1000-026_actualtests.html