IBM C1000-163 問題集

質問 1：
Which of these statements is true about network objects?
A. A network object represents a single asset that is connected to a network.
B. A network object can have multiple CIDR ranges assigned to it.
C. A network object is a group of assets that are connected to a network.
D. A network object must have at least one CIDR range per QRadar domain.
正解：B

質問 2：
Which of the following are true about Data node?
A. A data node is an appliance that you can add to your event and flow processors to increase storage capacity and improve search performance.
B. Each data node can be connected to many processors.
C. You can add an limited number of data nodes to your IBM QRadar deployment
D. Each data node can be connected to only one processor.
正解：A,D

質問 3：
In a multitenant environment, what is prevented by assigning log sources to a specific domain?
A. No security roles need to be created
B. User creation for each domain
C. Data integrity
D. Data leakage and data separation across domains
正解：D

質問 4：
What is the minimum bandwidth required between the primary and the secondary nodes of a HA cluster?
A. 100 Mbps
B. 1 Mbps
C. 10 Gbps
D. 1 Gbps
正解：D

質問 5：
A company is developing a QRadar app. They are already running apps on an App Host.
Which of these proposed scenarios do you suggest?
A. Run the new app on the existing App Host
B. Add another App Host as a sandbox for the new application
C. Run the new app on the console
D. Move running apps back to the Console and run the new app on the App Host
正解：A

質問 6：
Which regex statement extracts the DNS host from the cs-host value from the payload?
A. cs-host=(?:www\.)?([^\|]*)\|(?:http|ftp|tcp|https)\s+(?:www\.)?([^\s]+)
B. cs-host=www.?([^\|]*)\
C. cs-host=(?:www\.)?([^\|]*)\|(?:add|get|query|delete)\s+(?:www\.)?([^\s]+)
D. cs-host=.?www.(.*.?)
正解：A

質問 7：
All appliances must be on the same version and patch level prior to an upgrade.
How are the patch levels verified for all systems in a deployment?
A. Under the Dashboard tab > System Monitoring > System Summary item
B. Run /opt/qradar/support/all_servers.sh -C -k /opt/qradar/bin/myver -v
C. Run /opt/qradar/bin/applianceVer -v
D. Run qradarver -v
正解：B

質問 8：
How can you check the amount of used and available RAM on a QRadar appliance?
A. free
B. ramstat
C. topmem
D. memoryfree
正解：A

質問 9：
A QRadar deployment professional designs a multi-tenant environment where each tenant is permitted a quantity of events per second (EPS).
In a discussion with the service provider (who provides the security monitoring services to each tenant), how should the deployment professional describe the licensing options available?
A. Per-tenant EPS limits can be set, but any events over the EPS will be dropped from the pipeline; over- license buffering will not be used to handle EPS spikes.
B. If each domain and tenant is defined by log source groups, the EPS limit can be shared by the log source groups used for each tenant. Over-license buffering is defined at the event collector.
C. Per-tenant EPS limits can be set if the tenants are defined by event collectors. Then over-license buffering can be used to handle EPS spikes.
D. The domain sets EPS limits, so each tenant needs to have only one domain. This way, over-license buffering can be used to handle EPS spikes.
正解：D