IBM C2150-614 問題集

質問 1：
A Deployment Processional is performing a new deployment and needs to collect flows through NetFlow
version 5, Netflow version 9, IPFIX and Sflow. The network is complex and heterogeneous.
What is the minimum number of flow sources that are needed for this IBM Security QRadar SIEM 7.2.7
deployment?
A. 2
B. 3
C. 4
D. 1
正解：B
解説: (Topexam メンバーにのみ表示されます)

質問 2：
A Deployment Professional wants to reduce the number of false positives being generated by a
WebSense log source.
Which rule test could be created to solve this problem, assuming the Building Blocks have been updated
for the customer's environment?
A. "and NOT when an event matches any of the following BB:HostDefinition: Trusted Network Source IP"
B. "and NOT when an event matches any of the following BB:HostDefinition: VA Scanner Source IP"
C. "and NOT when an event matches any of the following BB:HostDefinition: Network Management
Servers"
D. "and NOT when an event matches any of the following BB:HostDefinition: Proxy Servers"
正解：B
解説: (Topexam メンバーにのみ表示されます)

質問 3：
A client has reached the maximum of 5000 EPS for their 3128 All-in-One appliance. They have just
completed an acquisition of a competitor company and would like to get them on-board with collecting
events for correlation in QRadar. It has been determined that the newly acquired company has a large
number of log sources, and it is estimated that its total EPS will be approx. 22000 EPS.
What will meet the hardware requirements when changing to a distributed environment?
A. 1624 Event Processor
B. 1605 Event Processor
C. 1628 Event Processor
D. 1622 Event Processor
正解：C
解説: (Topexam メンバーにのみ表示されます)

質問 4：
A Deployment Professional is performing a new deployment, and the customer wants to monitor network
traffic by sending raw data packets from a network device to IBM Security QRadar SEAM V7.2.7.
Which method should be used?
A. AGP card
B. SFlow protocol
C. Napatech card
D. NetFlow protocol
正解：C
解説: (Topexam メンバーにのみ表示されます)

質問 5：
A Deployment Professional is looking over event and flow data for a new customer and sees that the
customer is hitting 4,000 EPS/300,000 FPM, with bursts of up to 5,000 EPS/400,000 FPM. The customer
is asking for the least amount of appliances to be installed to handle this traffic without any throttling.
Which combination should be installed?
A. Install the IBM Security QRadar 3105 (Console) and add a QRadar Flow Processor 1828
B. Install the IBM Security QRadar 3105 (Console) and add a QRadar 1805
C. Install the IBM Security QRadar 3105 (Console) and add a QRadar Event Processor 1605
D. Install the IBM Security QRadar 3105 (Console) and add a QRadar Flow Processor 1705
正解：D
解説: (Topexam メンバーにのみ表示されます)

質問 6：
During a new IBM Security QRadar V7.2.7 deployment, a Deployment Professional is performing a
deployment in a client environment where there is no tab or SPAN to take advantage of QRadar's Internal
Flow sources.
What could be a valid External flow source for collecting flows?
A. Napatech Card
B. Network card
C. SNMP protocol
D. NetFlow protocol
正解：D
解説: (Topexam メンバーにのみ表示されます)