IBM C1000-162 問題集

質問 1：
Which property types can be used to reduce the overall data volume searched and shorten search time to address searches taking longer than expected?
A. Stored properties
B. Indexed properties
C. Tabled properties
D. Common properties
正解：B
解説: (Topexam メンバーにのみ表示されます)

質問 2：
Which parameters are used to calculate the magnitude rating of an offense?
A. Relevance, credibility, time
B. Severity, relevance, credibility
C. Severity, impact, urgency
D. Relevance, urgency, credibility
正解：B
解説: (Topexam メンバーにのみ表示されます)

質問 3：
Which reference set data element attribute governs who can view its value?
A. Tenant Assignment
B. Origin
C. Reference Set Management MSSP
D. Domain
正解：D
解説: (Topexam メンバーにのみ表示されます)

質問 4：
Which statement regarding the time series chart is true?
A. The length of time that is required to export your data depends on the number of parameters specified
B. It displays interactive time series charts that represent the records that match a specific time range search
C. The length of time that is required to export your data depends on the number of parameters specified and hidden
D. It displays static time series charts that represent the records that match and unmatch a specific time range search
正解：B
解説: (Topexam メンバーにのみ表示されます)

質問 5：
Where can you view a list of events associated with an offense in the Offense Summary window?
A. Display > Destination IPs
B. Source IPs
C. Events from Event/Flow count column
D. Destination IPs
正解：C
解説: (Topexam メンバーにのみ表示されます)

質問 6：
In QRadar. what do event rules test against?
A. The parameters of an offense to trigger more responses
B. Incoming flow data that is processed by the QRadar Flow Processor
C. Event and flow data
D. Incoming log source data that is processed in real time by the QRadar Event Processor
正解：D
解説: (Topexam メンバーにのみ表示されます)

質問 7：
A new log source was configured to send events to QRadar to help detect a malware outbreak. A security analyst has to create an offense based on properties from this payload but not all the information is parsed correctly.
What is the sequence of steps to ensure that the correct information is pulled from the payload to use in a rule?

正解：

Explanation:
* Identify a value from the event payload that will be used as the basis for this threat detection. You must first determine the specific piece of information within the log payload that signals the malware outbreak activity you want to detect.
* Create a custom property to extract the value from the logs. QRadar needs a custom property to isolate this specific value from the raw log data in a structured way.
* Ensure the custom property is optimized and enabled. Optimize the custom property's extraction method for accuracy and efficiency. Ensure it's enabled, so QRadar actively parses this data element.
* Create and Configure a rule to create an offense that uses the custom property as the offense index field. Now that the custom property is ready, create a rule that references this property. Designate the custom property as the rule's offense index field to ensure offenses are correctly grouped based on the extracted malware indicator.
A screenshot of a computer Description automatically generated


質問 8：
When using the Dynamic Search window on the Admin tab, which two (2) data sources are available?
A. SAVED SEARCHES
B. OFFENSES
C. PAYLOAD
D. AOL QUERY
E. ASSETS
正解：B,E
解説: (Topexam メンバーにのみ表示されます)

質問 9：
An analyst must create a reference set collection containing the IPv6 addresses of command-and-control servers in an IBM X-Force Exchange collection in order to write a rule to detect any enterprise traffic with those malicious IP addresses.
What value type should the analyst select for the reference set?
A. AlphaNumeric (Ignore Case)
B. IP
C. IPv6
D. IPv4 or IPv6
正解：C
解説: (Topexam メンバーにのみ表示されます)