IBM Security QRadar SIEM V7.5 Deployment 認定 C1000-163 試験問題:

1. From which tabs can a QRadar custom rule be created?

A) Offenses, Log Activity or Network Activity tabs
B) Offenses or Log Activity tabs
C) Offenses or Admin tabs
D) Log Activity or Network Activity tabs

2. What approach does QRadar take when it imposes EPS license (not hardware) limits on events that temporarily spike above that limit?

A) Excessive events in a spike cause a System Notification that advises the customer to increase their EPS license allocation.
B) During the spike, excess events are written to a queue, and they are processed after the EPS rate drops.
C) QRadar EPS license allocation is implemented with a hard cutoff to ensure resources are not saturated.
D) QRadar EPS licensing is measured as an average over a 24-hour period, which allows spikes to be handled gracefully.

3. A QRadar deployment professional is asked to migrate the configuration of a system from Log Manager to QRadar SIEM.
How should the custom rules, saved searches, and reports be migrated?

A) Use the content management tool (CMT) to transfer the security configuration.
B) Use rsync to transfer the contents of the /store partition to the new system.
C) Use the QRadar config backup and restore process to transfer all configurations.
D) The only option is to use the GUI to manually recreate any required content.

4. Which utility is used for checking the integrity of event and flow logs?

A) check_postgre_integrity.sh
B) check_ariel_integrity.sh
C) check_data_integrity.sh
D) check_database_integrity.sh

5. What is the network interface requirement for adding a secondary HA node to the primary HA node?

A) A crossover connection needs to be configured on all bonded interfaces.
B) The primary host cannot contain more physical interfaces than the secondary host.
C) A crossover connection between the primary and secondary host is needed.
D) All the network interfaces on the primary and secondary host should be bonded.

質問と回答：