Free IBM Security QRadar SIEM V7.4.3 Deployment Exam C1000-140 Exam Practice Test

For the management of applications with Qradar Assistant, which of these is not an option?

• Pause All Instances
• Create New Instance
• Start All Instances
• Delete All Instances

The /store for a QRadar HA setup was migrated to a Fibre Channel device. High Availability is not needed on this cluster, and it needs to be disconnected.What changes are required before disconnecting the HA cluster in this scenario?

• Edit the /etc/fstab on only the primary HA host to remove the noauto option from /store and /storetmp.
• Edit the /etc/fstab on only the secondary HA host to remove the noauto option from /store and /storetmp.
• Edit the /etc/fstab on the primary HA host and secondary HA host to remove the noauto option from /store and /storetmp.
• No changes are required before disconnecting the HA cluster.

A deployment professional is about to add a secondary appliance to a QRadar high availability deployment. It is confirmed that both the primary and the secondary appliances are on the same QRadar version. However, the hardware configuration of both appliances is different.What must be confirmed before adding the secondary appliance to the high availability deployment?

• The combined size of the /store and /transient partitions on the primary host must be larger than the /store partition on the secondary host.
• The secondary host must use a different management interface than the primary HA host.
• The primary host must contain more physical interfaces than the secondary.
• The combined size of the /store and /transient partitions on the secondary host must be equal to or larger than the /store partition on the primary host.

What can content management scripts be used to accomplish?

• Update QRadar.
• Export content from a QRadar deployment.
• Debug the default configuration in QRadar.
• Extract the list of offenses in QRadar.

Which log source should be used to filter QRadar audit events?

• Health Metrics-2
• SIM Audit-2
• Audit-log
• SIM-Audit-log

Which of these items is updated when vulnerability scan results from third-party vulnerability scanners are imported into QRadar?

• Assets
• Flow sources
• Event sources
• Vulnerability scanner sources

A QRadar deployment professional needs to transfer the configuration of a distributed environment (one Console and one EP, not using HA) onto an All-in-One (AIO) system to run some forensics against data that will be added later.What approach should the deployment professional suggest for building the new AIO?

• Use rsync to transfer the contents of the /store partition to the new system.
• The configuration of the source environment should be backed up and then restored on the new AIO. After the system is up, the EP can be removed by use of the GUI.
• Because the destination environment does not have the same number of appliances, the only option is to use the content management tool (CMT) to transfer the security configuration.
• The configuration of the source environment should be backed up and then restored on the new AIO. After the system is up, the EP can be removed only by use of back-end PSQL commands.

What approach does QRadar take when it imposes EPS license (not hardware) limits on events that temporarily spike above that limit?

• Excessive events in a spike cause a System Notification that advises the customer to increase their EPS license allocation.
• QRadar EPS license allocation is implemented with a hard cutoff to ensure resources are not saturated.
• During the spike, excess events are written to a queue, and they are processed after the EPS rate drops.
• QRadar EPS licensing is measured as an average over a 24-hour period, which allows spikes to be handled gracefully.

Where does QRadar display R2R events?

• The Network Activity tab
• The Remote Services window
• The Tuning interface in the Use Case Manager app
• The Testing interface in the Log Source Manager app

A QRadar deployment professional wants to integrate a dynamic data set like asset information so that QRadar can use the latest information in the new data set to correlate the rules and alerts.How can the deployment professional achieve this?

• Use the QRadar Search to search each item in the list of imported data set.
• Import the dynamic data in the reference set and use these reference sets in rules and building blocks.
• Use the Threat Intelligence app.
• Use the UCM app.