IBM C1000-018 問題集

質問 1：
Which statement about False Positive Building Blocks applies?
Using False Positive Building Blocks:
A. helps to prevent unwanted alerts, and reduces the performance impact of testing rules that do not need to be tested.
B. has no impact on unwanted alerts, or performance.
C. helps to prevent unwanted alerts, but there is no effect on performance.
D. has no impact on unwanted alerts, but it does reduce the performance impact of testing rules that do not need to be tested.
正解：C

質問 2：
The graph below shows a time series of a value. A rule has been created which will trigger at the indicated point.

Which type of QRadar rule has been used?
A. Threshold Rule
B. Anomaly Rule
C. Common Rule
D. Behavioral Rule
正解：A

質問 3：
Where can an analyst investigate a security incident to determine the root cause of an issue, and then work to resolve it?
A. Network Activity tab
B. Vulnerabilities tab
C. Offense tab
D. Risk tab
正解：B

質問 4：
Which considering the ability to tune False Positives with the Confidence factor Setting, which statement applies?
A. Secure areas should have a lower confidence value, while less secure areas should have a higher confidence value.
B. To ensure that the results are comparable, it is important to apply a common Confidence Factor across all network segments.
C. Secure areas should have a higher confidence value, while less secure areas should have a lower confidence value a higher,,
D. When setting a confidence factor, using a higher value will result in a higher number of Offenses.
正解：C

質問 5：
An analyst needs to investigate an Offense and navigates to the attached rule(s).
Where in the rule details would the analyst investigate the reason for why the rule was triggered?
A. Rule responses
B. Rule actions
C. List of test conditions
D. Rules response limiter
正解：D