IBM C1000-018 問題集

質問 1：
QRadar collects information from numerous log sources and other agents. Sometimes these agents stop reporting to QRadar for a variety of reasons. There is a default rule in QRadar to help identify these cases called the Device Stopped Sending Events (DSSE) Rule.
What does the DSSE Rule do?
A. It checks for log sources which are reporting that they have not had any communication in a certain amount of time.
B. It runs when there is an absence of Events.
C. It listens for log sources that send out regular health events and triggers the Rule when encountered
D. It checks for Rules which have fired due to an absence of Events.
正解：D

質問 2：
Which component in QRadar collects and creates flow information?
A. sflow
B. J-Flow
C. Qflow
D. NetFIow
正解：C
解説: (Topexam メンバーにのみ表示されます)

質問 3：
An analyst needs to find all events that are creating offenses that are triggered by rules that contain the word suspicious in the rule name.
Which query can the analyst use as a working sample?
A. SELECT LOGGEDOFFENSE(logsourceid), * from offense_events where RULENAME(creeventlist) ILIKE ,%suspicious%'
B. SELECT LOGSOURCERULES(logsourceid), " from rule_events where RULENAME(creeventlist) ILIKE '%suspicious%'
C. SELECT LOGSOURCENAME(logsourceid), * from events where RULENAME(creeventlist) ILIKE
'%suspicious%'
D. SELECT LOGSOURCETYPE(logsourceid), - from log_events where RULENAME(creeventlist) ILIKE '%suspicious%'
正解：C

質問 4：
How does an analyst view the base64 encoded string of an event's raw payload that contains unprintable characters?
A. Right click on the event -> view base64 data
B. Log Activity -> Under Payload Information, click base64 tab
C. Admin -> Under Payload Information, click base64 tab
D. Copy the raw payload and use an external tool to view base64 data
正解：A

質問 5：
What information is included in flow details but is not in event details?
A. Log source information
B. Network summary information
C. Magnitude information
D. Number of bytes and packets transferred
正解：B
解説: (Topexam メンバーにのみ表示されます)