IBM C1000-055 問題集

質問 1：
A customer is building a big data solution which aims to perform long term analysis of security data. Security events that are processed by QRadar are also relevant for the system and according to the QRadar administrator the most straightforward option for data ingestion is to configure event forwarding on QRadar.
The customer would like to make use of QRadar's parsing capability and its built-in parsers instead of developing new parsers for the big data platform. A deployment professional is asked for advice about the data format to configure for the event forwarding.
Which available option should the deployment professional propose?
A. Payload
B. XML
C. JSON
D. Normalized
正解：D

質問 2：
A QRadar customer has a custom log source. The deployment professional has already created a custom DSM for the log source and all incoming events are correctly parsed and mapped to a QID. Now, in addition to the currently parsed properties, the customer requires that the information about the last logged in user is recorded in the asset database.
How can the deployment professional fulfill the requirement?
A. Use the DSM editor to create an expression for the Username property so it is correctly parsed. Create an expression for any available identity property and make sure it is correctly parsed. It is automatically applied to all events with low level category "User login success".
B. Use the DSM editor to ensure that the Username property is correctly parsed. Create an expression for any available identity property and ensure it is correctly parsed. Also, in the DSM editor, enable the identity data for the login success event type.
C. Use the DSM editor to create an expression for the Identity Username property and make sure it parses correctly. It is automatically applied to all events with low level category "User login success".
D. Use the DSM editor to ensure that the Identity Username property is correctly parsed. Create an expression for any available identity property and ensure it is correctly parsed. Also, in the DSM editor enable identity data for the login success event type.
正解：C

質問 3：
A deployment professional has to decide where data will be stored in a newly configured environment to submit a plan for storage and network connectivity bandwidth.
Which QRadar components within a deployment can store raw or normalized events locally? (Choose two)
A. Event Collector
B. Flow Collector
C. Event Processor
D. Data Diode
E. Data Node
正解：C,E
解説: (Topexam メンバーにのみ表示されます)

質問 4：
Some customers do not fully understand the benefits of using dedicated appliances to collect events and flows, complaining about the complexity of the deployments.
How should the deployment professional clarify any doubts that may arise?
A. Event Processor collect events from various log sources and continuously forwards these events to an Event Collector.
B. Dedicated event collectors when deployed in VMs include an on-board event processor that can be directly attached to an All-in-One Virtual console type 3199.
C. The operation of the QRadar security intelligence platform consists of three layers, and applies to any QRadar deployment structure, regardless of its size and complexity.
D. Using All-in-One appliances are a good choice for environments greater than 100.000 EPS.
正解：D

質問 5：
A deployment professional sees the following notification in the IBM QRadar Notification Section. "The Accumulator has fallen behind." To which performance issues does the notice refer to?
A. Event Pipeline
B. Global Views
C. External Storage
D. Flow Pipeline
正解：C

質問 6：
During a new deployment, the client states that they want to collect windows logs and forward them to QRadar, but they are already using another agent to collect logs for a managed service provider [MSP] The client would like to continue forwarding these logs to the MSP as well as send them to QRadar.
Which architectural solutions would meet the client's requirements?
A. Configure windows MSRPC protocol to send events to both.
B. Configure Windows Event Forwarding to send events to both destinations.
C. Install an unmanaged Wincollect instance and a setup multiple forwarding destinations to the Wincollect configuration server.
D. Install a managed Wincollect instances and setup multiple forwarding destinations.
正解：A