Free IBM Certified Analyst – Security QRadar SIEM V7.5 Exam C1000-162 Exam Practice Test

Which kind of information do log sources provide?

• User login actions
• Operating system updates
• Flows generated by users
• Router configuration exports.

What is an effective method to fix an event that is parsed an determined to be unknown or in the wrong QReader category/

• Create a DSM extension to extract the category from the payload
• Create a Custom Property to extract the proper Category from the payload
• Open the event details, select map event, and assign it to the correct category
• Write a Custom Rule, and use Rule Response to send a new event in the proper category

Offense chaining is based on which field that is specified in the rule?

• Rule action field
• Offense response field
• Rule response field
• Offense index field

Create a list that stores Username as the first key. Source IP as the second key with an assigned cidr data type, and Source Port as the value.The example above refers to what kind of reference data collections?

• Reference map of sets
• Reference store
• Reference table
• Reference map

Which two high level Event Categories are used by QRadar? (Choose two.)

• Policy
• Direction
• Localization
• Justification
• Authentication

Which two (2) types of categories comprise events?

• Unsupported
• Unfound
• Stored
• Found
• Parsed

The Use Case Manager app has an option to see MITRE heat map.Which two (2) factors are responsible for the different colors in MITRE heat map?

• Number of offenses generated
• Number of events associated to offense
• Number of rules mapped
• Level of mapping confidence
• Number of log sources associated

Which two (2) options are used to search offense data on the By Networks page?

• Raw/Flows
• Events/Flows
• NetIP
• Severity
• Network

The Pulse app contains which two (2) widget chart types?

• Small number chart
• Hexadecimal chart
• Binary chart
• Scatter chart
• Big number chart

What does an analyst need to do before configuring the QRadar Use Case Manager app?

• Create a privileged user.
• Run a QRadar health check.
• Check the license agreement.
• Create an authorized service token.