Try Free IBM C1000-055 Sample Questions and Answers

test2022-06-10T06:28:26+00:00

You can try free IBM C1000-055 Sample Questions and Answers for your IBM QRadar SIEM V7.3.2 Deployment exam. FreeTestShare C1000-055 exam questions are available online to provide you with the latest C1000-055 exam questions with the precise answer to make sure that you can prepare for C1000-055 exam well and finally, you can pass IBM C1000-055 exam successfully. With IBM C1000-055 Sample Questions and Answers, you don’t need to go to academy classes as you can practice IBM C1000-055 practice questions and answers by just sitting on your real exam.

Try C1000-055 free demo to test yourself!

Page 1 of 2

1. A company has specific data retention policies to keep log data online for 5 years. The current QRadar storage will not handle this amount of data.

Which are possible solutions? (Choose two)

Migrate the QRadar /store/ariel file system to a larger off board storage device

Implement Data Node(s)

Implement Event Collector(s)

Implement Flow Processor(s)

Implement a high availability (HA) solution

2. A deployment professional wishes to implement a QRadar product which provides network topology, active attack paths and high-risk assets risk-score adjustment on assets based on policy compliance.

Which product would the deployment professional deploy to achieve this?

QRadar Risk Manager

QRadar Topology Scanner

QRadar Incident Forensics

QRadar Vulnerability Scanner

3. QRadar is configured to periodically update an IP address list from a 3rd party threat intelligence provider using the Threat Intelligence app. The IP address data is used in a CRE rule to create an offense in case a connection attempt toward any IP address on the list is seen.

Which QRadar component stores the collected IP address data?

Building Block

X-Force Threat Feed

Reference Set

Custom Rule

4. A deployment professional needs to configure the X-Force Threat Intelligence Feed through a web proxy to access the cloud servers hosting the information.

How should the deployment professional configure the proxy for this access?

Edit the Vetc/httpd/conf.d/ssl.conf and Vopt/qradar/dca/server.ini' files on the Console and restart some services

Reconfigure iptables access on each managed host to provide access to 'update.xforce-security.com' and 'license.xforce-security.com' and restart some services

Complete the 'Server Config' values in the Advanced Update Configuration section of Auto Updates )

Complete the 'System Proxy' values in the Advanced System Settings section of the Admin tab

5. What are anomaly detection rules used for?

Detecting volume changes that occur in regular patterns.

Detecting event traffic.

Detecting an activity that is greater or less than a specified range.

Detecting when unusual traffic patterns occur in the network.

6. During a new deployment, the client states that they want to collect windows logs and forward them to QRadar, but they are already using another agent to collect logs for a managed service provider [MSP] The client would like to continue forwarding these logs to the MSP as well as send them to QRadar.

Which architectural solutions would meet the client's requirements?

Install an unmanaged Wincollect instance and a setup multiple forwarding destinations to the Wincollect configuration server.

Configure windows MSRPC protocol to send events to both.

Install a managed Wincollect instances and setup multiple forwarding destinations.

Configure Windows Event Forwarding to send events to both destinations.

7. A deployment professional needs to clear out the Asset Database in IBM QRadar .

Which service on the Console is restarted when script cleanAssetModel.sh is executed?

PostgressDB

Hostcontext

Hostservices

Tomcat

8. The deployment professional needs to pull events from an HR system that are recorded in a database .

Which protocol would be used to collect the data?

OPSEC/LEA

JDBC

syslog

HTTP

9. A deployment professional has been asked to create some Reference Data to be used to provide additional information in the results of Ariel Query Language (AQL) queries. The data will enable a lookup that finds the users's Department based on the username which will be returned by the required AQL function when looked up in the reference data.

Which Reference Data should the deployment professional create for this purpose?

Reference Map

Reference Map of Tables

Reference Set

Reference Map of Sets

10. An application developer is working on a reporting tool that fetches and visualizes data from multiple data sources. The deployment professional is asked to explain how to make authenticated requests on QRadar using its REST API interface.

Which authentication method is supported by QRadar's REST API?

Authorization token in an HTTP header

Authorization token in an LTPA token

Authorization token in an HTTP query string

Authorization token in an JWT token

Page 2 of 2

11. A deployment professional is redesigning the existing deployment to add a event processor due to an increased event rate. The deployment professional observes the events per second (EPS) to be a collective 30,000 EPS from two event collectors (EC1 and EC2) and sometimes exceeds the EPS capacity. EC1 and EC2 are in same network segment.

Considering there are more licenses available than needed in the license pool, which processor should the deployment professional replace the event collector(s) with?

Replace EC1 with one QRadar Event Processor 1648

Replace EC1 and EC2 with one QRadar Event Processor 1605

Replace EC1 and EC2 with one QRadar Event Processor 1629

Replace EC1 with one QRadar Event Processor 1605

12. A customer has a Network Vulnerability Scanner which is not supported by IBM QRadar.

How can a deployment professional integrate such a scanner with IBM QRadar?

Creating a uDSM using the DSM Editor

Using the AXIS Scanner option of IBM QRadar

By creating a Log Source Extension (LSX)

Using a Custom Flow Source

13. A deployment professional is about to execute Server Discovery to populate the Host Definition Building Blocks. The deployment professional is working in a monitored environment and does not wish to set off any network scanner alarms.

What step should the deployment professional take to ensure that good results are returned and that no alarms are raised?

Warn the network monitoring team that QRadar is about to run a network port scan

Set the 'Passive discovery' flag in Advanced System Settings in the Admin tab

Ensure that events from the relevant servers are being collected successfully

Ensure that the flow sources are configured correctly and collecting data

14. During an initial deployment, three retention buckets (longret, midret. testret) were configured with the following characteristics, being (X) the number of the bucket:

longret (1): keep data in this bucket for 2 years. Delete when storage is needed.

midret (2): keep data in this bucket for 6 months. Delete when storage is needed.

testret (3): keep data in this bucket for 3 days. Delete immediately after expiration.

Default (0) retention bucket has a 3 months / delete immediately policy.

During testing last week, a significant amount of test data has been mistakenly categorized as "longret". This bucket does not contain any other important information. Everything else, including some important data, has been saved into the default bucket.

How can the deployment professional remove all data stored in the "longret" bucket?

Manually delete old data from last week by issuing a rm * on /store/ariel/events/payloads/ and /store/ariel/events/records/ and select the directories containing events from the last week

Change the longret bucket period to 10 days and deploy the changes.

Change the system's time to 2 years in the future and wait until deletion has been made and then go back to the real system's time.

Manually delete the files ending by -1 from /store/ariel/events/payloads/ and /store/ariel/events/records/

15. A deployment professional sees the following notification in the IBM QRadar Notification Section. "The Accumulator has fallen behind."

To which performance issues does the notice refer to?

Flow Pipeline

External Storage

Event Pipeline

Global Views

Try Free IBM C1000-055 Sample Questions and Answers

Try Free IBM C1000-055 Sample Questions and Answers

Share this post

Author

Leave a Reply Cancel reply

Related Posts