IBM C1000-055 問題集

質問 1：
A company that is located in the United States wants to expand its existing QRadar deployment to data centers located in Europe. The European branch needs to keep its data in-country and must comply with local data retention regulations.
What can the deployment professional do to comply with local data laws?
A. Install Data Nodes in the European data center.
B. Install Event and Flow Processors in the European data center.
C. Install Event and Flow Processors in the United States data center.
D. Install Event and Flow Collectors in the European data center.
正解：D

質問 2：
A deployment professional needs to implement a crossover cable in the high availability (HA) environment.
By doing so, this QRadar deployment isolates what kind of traffic over the crossover connection?
A. query
B. event
C. HA replication
D. flow
正解：B

質問 3：
A QRadar customer has a custom log source. The deployment professional has already created a custom DSM for the log source and all incoming events are correctly parsed and mapped to a QID. Now, in addition to the currently parsed properties, the customer requires that the information about the last logged in user is recorded in the asset database.
How can the deployment professional fulfill the requirement?
A. Use the DSM editor to create an expression for the Username property so it is correctly parsed. Create an expression for any available identity property and make sure it is correctly parsed. It is automatically applied to all events with low level category "User login success".
B. Use the DSM editor to ensure that the Username property is correctly parsed. Create an expression for any available identity property and ensure it is correctly parsed. Also, in the DSM editor, enable the identity data for the login success event type.
C. Use the DSM editor to create an expression for the Identity Username property and make sure it parses correctly. It is automatically applied to all events with low level category "User login success".
D. Use the DSM editor to ensure that the Identity Username property is correctly parsed. Create an expression for any available identity property and ensure it is correctly parsed. Also, in the DSM editor enable identity data for the login success event type.
正解：C

質問 4：
A deployment professional has been asked to create some Reference Data to be used to provide additional information in the results of Ariel Query Language (AQL) queries. The data will enable a lookup that finds the users's Department based on the username which will be returned by the required AQL function when looked up in the reference data.
Which Reference Data should the deployment professional create for this purpose?
A. Reference Map of Tables
B. Reference Set
C. Reference Map
D. Reference Map of Sets
正解：D

質問 5：
A client uses the IBM Security QRadar Vulnerability Manager to discover vulnerabilities on the network devices, applications, and software. They run the QRadar Vulnerability Manager from an All-in-one system, where the scanning and processing functions are on the Console. As the client's QRadar deployment is growing, they are also considering deploying scanners.
What is a valid client motivation for deploying additional scanners?
A. To find more vulnerabilities on a given system.
B. To scan an asset in the same geographic region as the QRadar Vulnerability Manager processor.
C. To avoid scanning through a firewall that is a log source.
D. To patch assets for their vulnerabilities.
正解：A

質問 6：
QRadar is configured to periodically update an IP address list from a 3rd party threat intelligence provider using the Threat Intelligence app. The IP address data is used in a CRE rule to create an offense in case a connection attempt toward any IP address on the list is seen.
Which QRadar component stores the collected IP address data?
A. Reference Set
B. Building Block
C. X-Force Threat Feed
D. Custom Rule
正解：C