C1000-163 by IBM Actual Free Exam Q&As

Question 1

Which port is required to ensure that the HA nodes are still active?

A. 10101 B. 12500 C. 1000 D. 10102

Discussion 0

Correct Answer: A,D Vote an answer

Question 2

Which are stored events?

A. Events which cannot be coalesced B. Events that do not have the storage time in the payload C. Events that cannot be understood or parsed by QRadar D. All events in QRadar

Discussion 0

Correct Answer: C Vote an answer

Question 3

An analyst needs to preserve the data from a search to view later.
Which option should they select?

A. Save Search B. Save Results C. Save Criteria D. Save Data

Discussion 0

Correct Answer: B Vote an answer

Question 4

A QRadar deployment professional has been asked to merge two QRadar deployments (AIO_A and AIO_B) into one new environment (AIO_C). Each environment consists of an All-in-One appliance. There is no requirement to migrate the Ariel data.
What is the way to approach the migration?

A. Take a configuration backup of AIO_A and restore it onto AIO_B. Then take a configuration backup of AIO_B and restore it onto AIO_C. B. Take configuration backups of AIO_A and AIO_B. Merge the backup files with the UNIX merge command, then restore the merged file onto AIO_C. C. Take configuration backups of AIO_A and AIO_B. Restore AIO_A onto AIO_C, then restore AIO_B onto AIO_C. D. Take a configuration backup of AIO_A and a CMT export of AIO_B. Restore AIO_A onto AIO_C, then import the config export from AIO_B onto AIO_C.

Discussion 0

Correct Answer: D Vote an answer

Question 5

What is the default data retention period for a retention bucket?

A. 14 days B. 7 days C. 1 month D. 1 year

Discussion 0

Correct Answer: C Vote an answer

Question 6

Which type of information is considered as identity data for QRadar Assets?

A. MAC Address B. Destination Port C. Source Port D. Rule Name

Discussion 0

Correct Answer: A Vote an answer

Question 7

Which is a sign that the QRadar Network Hierarchy requires tuning?

A. The Use Case Manager does not load. B. Dashboards are not updating. C. MITRE tactics are blue. D. There are many Remote-to-Remote events.

Discussion 0

Correct Answer: D Vote an answer

Question 8

IBM provides a utility to move the data from an old appliance to a new appliance.
Which command runs that utility.

A. sh syncAriel.sh --i <IP address> B. sh syncData.sh --i <IP address> C. ./syncAriel.sh <IP address> D. ./syncData.sh <IP address>

Discussion 0

Correct Answer: B Vote an answer

Question 9

What is the minimum disk size for a QRadar virtual appliance installation?

A. 1024 GB B. 512 GB C. 256 GB D. 128 GB

Discussion 0

Correct Answer: C Vote an answer

Question 10

A new Console will be built on new hardware, to replace a Console on old hardware. No managed hosts will be migrated to the new hardware. The new Console will have a different IP address than the old Console.
What must be done on the managed hosts before a full deploy is done on the new Console?

A. Run a reboot to restart the managed hosts and to remove them from the old Console. B. Run systemctl stop iptables so the new Console can connect to the managed hosts. C. Run systemctl stop hostcontext, run the full deploy on the new Console, then run systemctl start hostcontext on the managed hosts. D. If the old Console is shutdown, and has its network cable removed, nothing needs to be done on the managed hosts.

Discussion 0

Correct Answer: B Vote an answer

Question 11

Analysts can filter searches in QRadar from which three (3) of these locations?

A. Reports search pages B. Dashboard Activity toolbar C. Admin search pages D. Add Filter dialog E. Network Activity toolbar F. Log Activity toolbar

Discussion 0

Correct Answer: D,E,F Vote an answer

Question 12

Which of the following utilities can be run on Qradar?

A. sqlmap B. nmap C. nc D. psexec

Discussion 0

Correct Answer: B,C Vote an answer

Question 13

A deployment professional needs to troubleshoot a QRadar application that is not working.
Which tool can be used to aid the troubleshooting of containers and container management on the QRadar Console or App Host?

A. qdocker ps B. q_trev.sh C. recon D. qapp_debug.sh

Discussion 0

Correct Answer: C Vote an answer

Question 14

What are unknown events?

A. None of the above B. The event cannot be understood or parsed by Qradar C. Both of the above D. The event is collected and parsed, but cannot be mapped or categorized to a specific log source.

Discussion 0

Correct Answer: D Vote an answer

Question 15

An organization's QRadar deployment was reviewed. It was determined that more storage is needed.
Which appliance should be deployed to meet this need?

A. Event Collector B. Data Node C. Flow Collector D. App Host

Discussion 0

Correct Answer: B Vote an answer

IBM Security QRadar SIEM V7.5 Deployment - C1000-163 Exam Practice Test