IBM Security QRadar SIEM V7.5 Deployment 認定 C1000-163 試験問題:

1. A new Console will be built on new hardware, to replace a Console on old hardware. No managed hosts will be migrated to the new hardware. The new Console will have a different IP address than the old Console.
What must be done on the managed hosts before a full deploy is done on the new Console?

A) Run systemctl stop hostcontext, run the full deploy on the new Console, then run systemctl start hostcontext on the managed hosts.
B) Run systemctl stop iptables so the new Console can connect to the managed hosts.
C) Run a reboot to restart the managed hosts and to remove them from the old Console.
D) If the old Console is shutdown, and has its network cable removed, nothing needs to be done on the managed hosts.

2. How can a QRadar user visualize the rules for MITRE ATT&CK coverage in Use Case Manager?

A) Use Case Explorer > under Rule and Building Block Filter, select Rule > click Apply Filter
B) Use Case Explorer > ATT&CK Actions > Coverage map and report
C) Use Case Manager > Active Rules
D) Use Case Manager > Settings > Sync QID Records

3. After a successful upgrade, which two actions does a deployment professional perform to complete the installation?

A) Delete the SFS file from all appliances.
B) Run mount /media/updates.
C) Clear the browser cache before logging in to the Console.
D) Rebuild the reference data.
E) Disconnect all managed host from the deployment.

4. A QRadar deployment professional wants to add entries from a .csv file to the Reference Set.
Which script that is included in QRadar can be used?

A) ReferenceDataUtil.sh
B) all_servers.sh
C) ReferenceImport.sh
D) validate_deployment.sh

5. Which is a sign that the QRadar Network Hierarchy requires tuning?

A) Dashboards are not updating.
B) MITRE tactics are blue.
C) The Use Case Manager does not load.
D) There are many Remote-to-Remote events.

質問と回答：