IBM C1000-055 問題集

質問 1：
A deployment professional is redesigning the existing deployment to add a event processor due to an increased event rate. The deployment professional observes the events per second (EPS) to be a collective 30,000 EPS from two event collectors (EC1 and EC2) and sometimes exceeds the EPS capacity. EC1 and EC2 are in same network segment.
Considering there are more licenses available than needed in the license pool, which processor should the deployment professional replace the event collector(s) with?
A. Replace EC1 and EC2 with one QRadar Event Processor 1605
B. Replace EC1 and EC2 with one QRadar Event Processor 1629
C. Replace EC1 with one QRadar Event Processor 1648
D. Replace EC1 with one QRadar Event Processor 1605
正解：B

質問 2：
A deployment professional receives instructions to virtualize the currently installed QRadar SIEM All-in-One appliance and to provide requirements. VM specifications must suffice for 4000 EPS.
What are the minimum processor and memory requirements that the deployment professional must use?
A. 32 GB Memory, 16 CPU Cores
B. 128 GB Memory, 16 CPU Cores
C. 256 GB Memory, 32 CPU Cores
D. 8 GB Memory, 4 CPU Cores
正解：D

質問 3：
A deployment professional is working with a client that develops their own in house applications. The customer would like to log events from these applications. Because these applications are hosted on Windows servers inside of the clients DMZ, the client wants to limit the ports on which they will allow access. All logs are written to a flat file named debugJog in the c:\app\logs folder of the host.
Which option is a developed strategy for integrating these logs with QRadar SIEM?
A. Install managed Wincollect instances on the servers, create a custom DSM and use the Wincollect Log Forwarder protocol to ingest events from the log file.
B. Install unmanaged Wincollect instances on the servers, create a custom DSM and use the Wincollect File Forwarder protocol to ingest events from the log file.
C. Create a custom DSM and use the MSRPC protocol communicate with the servers and ingest the log file.
D. Install managed Wincollect instances, create a custom DSM and use the Microsoft Security Event Log DSM to create a xpath query to ingest the data.
正解：B

質問 4：
Some customers do not fully understand the benefits of using dedicated appliances to collect events and flows, complaining about the complexity of the deployments.
How should the deployment professional clarify any doubts that may arise?
A. Event Processor collect events from various log sources and continuously forwards these events to an Event Collector.
B. Dedicated event collectors when deployed in VMs include an on-board event processor that can be directly attached to an All-in-One Virtual console type 3199.
C. The operation of the QRadar security intelligence platform consists of three layers, and applies to any QRadar deployment structure, regardless of its size and complexity.
D. Using All-in-One appliances are a good choice for environments greater than 100.000 EPS.
正解：D

質問 5：
A deployment professional needs to implement a crossover cable in the high availability (HA) environment.
By doing so, this QRadar deployment isolates what kind of traffic over the crossover connection?
A. query
B. event
C. HA replication
D. flow
正解：B

質問 6：
A deployment professional is asked to create QRadar deployment architecture for a company.
The company has three branch offices with WAN connection between them. The head office data center requires 14000 EPS and 200000 FPM. Each branch requires 4000 EPS and 200000 FPM.
Which deployment solution will meet the minimum requirements?
A. QRadar 3129 (All-in-One) in head office
B. QRadar 3105 (Console) and QRadar Event and Flow Processor 1829 in head office + QRadar 1805 Event and Flow Processor in each branch office
C. QRadar 3105 (Console) in head office + QRadar 1805 Event and Flow Processor in each branch office
D. QRadar 3129 (Console) in head office + QRadar 1805 Event and Flow Processor in each branch office
正解：C