[Nov 23, 2021] C1000-026 Ultimate Study Guide - PrepPDF
Ultimate Guide to Prepare C1000-026 Certification Exam for IBM Security in 2021
NEW QUESTION 37
An administrator is tasked to reduce data volumes in the asset database and reduce stale data contributing to asset growth deviation.
How can the administrator tune the configuration of the Asset Profiler?
- A. In the System Configuration section of the Admin, access the Asset Profile Configuration and increase the retention values for the Asset Profiler Retention Configuration and Save. Next, deploy the changes into the environment for the updates to take effect.
- B. In the System Configuration section of the Admin, access the Asset Profile Configuration and increase the retention values for the Asset Profiler Retention Configuration and Save. On the navigation menu, click Admin and from the Advanced menu, click Restart Event Collection Services. Next, deploy the changes into the environment for the updates to take effect.
- C. On the navigation menu, click Admin, click the Asset Profile Configuration and reduce the retention values for the Asset Profiler Retention Configuration and Save. On the navigation menu, click Admin and from the Advanced menu, click Restart Event Collection Services. Next, deploy the changes into the environment for the updates to take effect.
- D. In the System Configuration section of the Admin, access the Asset Profile Configuration and reduce the retention values for the Asset Profiler Retention Configuration and Save. Next, deploy the changes into the environment for the updates to take effect.
Answer: A
Explanation:
Reference:
https://www.ibm.com/support/knowledgecenter/en/SS42VS_7.3.2/com.ibm.qradar.doc/ t_qradar_adm_asset_tuning_ip_retention.html
NEW QUESTION 38
An administrator needs to import data into QRadar for a specific use case.
The data that has been provided to the administrator is stored in records that map a key to a value.
Which type of data collection must the administrator create?
- A. Reference map of sets
- B. Reference set
- C. Reference map of maps
- D. Reference map
Answer: A
Explanation:
Reference:
https://www.ibm.com/support/knowledgecenter/en/SS42VS_7.3.2/com.ibm.qradar.doc/ t_qradar_conifig_rul_resp_reference_set.html
NEW QUESTION 39
What is the minimum memory in gigabyte (GB) required for a QRadar All-in-One Virtual 3199 appliance?
- A. 0
- B. 1
- C. 2
- D. 3
Answer: A
Explanation:
Explanation/Reference:
Reference: https://www.ibm.com/support/knowledgecenter/en/SS42VS_7.3.1/com.ibm.qradar.doc/ c_qradar_ha_vrt_ap_reqs.html
NEW QUESTION 40
An administrator needs data backup.
What information is contained in the data backup?
- A. Audit log information, Event data, Indexes, Index management information, Flow data, Report data
- B. Audit log information, Event data, Indexes, Index management information, Flow data, Report data, Groups
- C. Audit log information, Event data, Flow data, Report data, Indexes
- D. Audit log information, Event data, Flow data, Report data, Indexes, Log sources
Answer: C
Explanation:
Explanation/Reference: https://www.ibm.com/support/knowledgecenter/en/SS42VS_7.3.0/com.ibm.qradar.doc/ c_qradar_adm_man_back_recovery.html
NEW QUESTION 41
An administrator needs data backup.
What information is contained in the data backup?
- A. Audit log information, Event data, Indexes, Index management information, Flow data, Report data
- B. Audit log information, Event data, Indexes, Index management information, Flow data, Report data, Groups
- C. Audit log information, Event data, Flow data, Report data, Indexes
- D. Audit log information, Event data, Flow data, Report data, Indexes, Log sources
Answer: C
NEW QUESTION 42
An administrator has reviewed the list of new features in the QRadar V7.3.2 release notes, and decides to upgrade their system to this version.
What is the minimum supported version that the administrator can upgrade from?
- A. 7.3.1
- B. 7.3.0
- C. 7.2.8
- D. 7.2.6
Answer: D
Explanation:
Reference:
https://www.ibm.com/support/pages/release-qradar-v732-sfs-73220190201201121
NEW QUESTION 43
What should an administrator do to successfully upgrade an IBM Security QRadar system from an older version?
- A. Verify the upgrade path and update the QRadar apps.
- B. Verify the upgrade path, and review the software, hardware and high availability requirements.
- C. Review the software, hardware and high availability requirements, and consider to update the firmware on IBM Security QRadar appliances.
- D. Review the release notes and review the architecture.
Answer: B
Explanation:
Explanation/Reference: https://www.ibm.com/support/knowledgecenter/SS42VS_7.3.2/com.ibm.qradar.doc/ b_qradar_upgrade.pdf (9)
NEW QUESTION 44
An administrator logs into the QRadar Console to review the stored backup files. There is an exclamation mark beside some files.
What is the cause of this?
- A. Incomplete backup files
- B. Corrupted backup files
- C. Canceled backup files
- D. Missing backup files
Answer: D
NEW QUESTION 45
A QRadar administrator added High Availability (HA) to the Event Processor and needs to verify the crossover link status between the primary and secondary hosts.
Which commands can be used to verify the crossover status? (Choose two.)
- A. /opt/qradar/ha/bin/getStatus crossover
- B. /opt/qradar/ha/bin/ha_getstate.sh
- C. /opt/qradar/ha/bin/ha cstate
- D. /opt/qradar/ha/bin/qradar_nettune.pl linkaggr <interface> status
- E. /opt/qradar/ha/bin/qradar_nettune.pl crossover status
- F. cat /proc/drbd
Answer: E,F
Explanation:
Reference:
a87cdc445768
NEW QUESTION 46
An administrator receives an expensive custom rule notification.
Which tool can now be enabled via the Advanced 'System Settings' - Custom Rule Settings to help troubleshoot this?
- A. Offense Analysis
- B. Performance Analysis
- C. Rule Analysis
- D. Custom Rule Analysis
Answer: D
Explanation:
Explanation/Reference:
NEW QUESTION 47
A company has several appliances and the administrator needs to copy a file to all appliances to run some tests to verify the integrity of the processes. The /opt/qradar/support/all_servers.sh script can be used to issue commands to all QRadar appliances within the deployment.
What option must be used with the script to copy the file to all appliances in the deployment?
- A. /opt/qradar/support/all_servers.sh -g
- B. /opt/qradar/support/all_servers.sh -C
- C. /opt/qradar/support/all_servers.sh -p
- D. /opt/qradar/support/all_servers.sh -k
Answer: C
Explanation:
Explanation/Reference: https://www-01.ibm.com/support/docview.wss?uid=swg21998517
NEW QUESTION 48
An administrator needs to complete the upgrade process from V7.3.1 to V7.3.2.
What is the correct procedure?
- A. Do a clean installation using the ISO file on a bootable USB device
- B. Copy the SFS file extension to the recommended directories and use this file
- C. Use the ISO file to execute the upgrade process
- D. Copy the ISO file extension to the recommended directories and use this file
Answer: B
Explanation:
Reference:
https://www.ibm.com/support/knowledgecenter/SS42VS_7.3.2/com.ibm.qradar.doc/ t_qradar_up_ugrad_sys.html
NEW QUESTION 49
An administrator would like to categorize discovered assets by port definitions and add this information to a server type building block for further use.
Which QRadar Console functionality should the administrator use?
- A. Assets Tab - Server Discovery
- B. Assets Tab - Actions - Scan
- C. Admin Tab - Auto Update
- D. Admin - Scheduled Scans
Answer: A
Explanation:
Explanation/Reference: https://www.ibm.com/support/knowledgecenter/SS42VS_7.3.1/com.ibm.qradar.doc/ b_qradar_tuning_guide.pdf
NEW QUESTION 50
An administrator has reviewed the list of new features in the QRadar V7.3.2 release notes, and decides to upgrade their system to this version.
What is the minimum supported version that the administrator can upgrade from?
- A. 7.3.1
- B. 7.3.0
- C. 7.2.8
- D. 7.2.6
Answer: D
NEW QUESTION 51
An administrator plans to deploy multiple log sources that share a common configuration.
How many log sources can be added at one time?
- A. 0
- B. 1
- C. 2
- D. 3
Answer: D
Explanation:
Reference:
t_logsource_bulkadd.html
NEW QUESTION 52
An administrator enters the QRadar web console into a web browser but does not get a response.
Which process is responsible for the QRadar GUI?
- A. consoled
- B. guid
- C. tomcat
- D. magistrated
Answer: C
Explanation:
Reference:
https://www.ibm.com/support/pages/qradar-core-services-and-impact-when-restarted
NEW QUESTION 53
Which log should be reviewed to determine the reasons a patch installer did not proceed during a QRadar upgrade?
- A. /var/log/upgrade.log
- B. /var/log/setup-*/patches.log
- C. /var/log/qradar.log
- D. /var/log/qradar.audit
Answer: B
Explanation:
Explanation/Reference: https://www.ibm.com/support/pages/qradar-unable-run-patch-installer-and-update-exits-screen- terminating-message
NEW QUESTION 54
When an administrator attempts to edit a log source after upgrading QRadar, a Device Support Module (DSM), a protocol, or Vulnerability Information Services (VIS) components, the following error message appears.
An error has occurred. Refresh your browser (press F5) and attempt the action again. If the problem persists, please contact customer support for assistance.
What action should the administrator take to troubleshoot this issue? (Choose two.)
- A. systemctl restart httpd
- B. systemctl start tomcat
- C. systemctl restart ecs-ep
- D. systemctl restart snmpd
- E. Clear browser cache
- F. systemctl restart iptables
Answer: B,E
Explanation:
Reference:
t_QRadar_Troubleshooting_guide_PurgeFiles.html
NEW QUESTION 55
Which event routing rule is required to add QRadar Data Store (QDS) capability to a deployment?
- A. Log Only (exclude Analytics)
- B. Delete data When storage space is required
- C. Bypass Correlation
- D. Delete data immediately after the retention period has expired
Answer: A
Explanation:
Reference:
https://www.ibm.com/support/knowledgecenter/en/SS42VS_7.3.2/com.ibm.qradar.doc/ t_qradar_adm_data_store.html
NEW QUESTION 56
An administrator is tasked to reduce data volumes in the asset database and reduce stale data contributing to asset growth deviation.
How can the administrator tune the configuration of the Asset Profiler?
- A. In the System Configuration section of the Admin, access the Asset Profile Configuration and increase the retention values for the Asset Profiler Retention Configuration and Save. Next, deploy the changes into the environment for the updates to take effect.
- B. In the System Configuration section of the Admin, access the Asset Profile Configuration and increase the retention values for the Asset Profiler Retention Configuration and Save. On the navigation menu, click Admin and from the Advanced menu, click Restart Event Collection Services. Next, deploy the changes into the environment for the updates to take effect.
- C. On the navigation menu, click Admin, click the Asset Profile Configuration and reduce the retention values for the Asset Profiler Retention Configuration and Save. On the navigation menu, click Admin and from the Advanced menu, click Restart Event Collection Services. Next, deploy the changes into the environment for the updates to take effect.
- D. In the System Configuration section of the Admin, access the Asset Profile Configuration and reduce the retention values for the Asset Profiler Retention Configuration and Save. Next, deploy the changes into the environment for the updates to take effect.
Answer: A
Explanation:
Reference:
t_qradar_adm_asset_tuning_ip_retention.html
NEW QUESTION 57
Which app should be used for monitoring QRadar performance and health?
- A. QRadar Extension Management
- B. QRadar Performance Overview
- C. QRadar Monitoring Intelligence
- D. QRadar Deployment Intelligence
Answer: D
Explanation:
Reference:
https://www.ibm.com/support/knowledgecenter/en/SSKMKU/com.ibm.QDIapp.doc/ c_qapps_QDI_intro.html
NEW QUESTION 58
An administrator wants to upload a file with information related to network hierarchy instead of using the GUI wizard.
How can the administrator do this?
- A. Modify /opt/qradar/conf/remotenet.conf
- B. Use upload button in Network Hierarchy wizard
- C. Upload file using REST API
- D. Install application "Network Hierarchy Management for QRadar"
Answer: D
Explanation:
Reference:
https://www.ibm.com/support/pages/qradar-restoring-network-hierarchy-using-network-hierarchymanagement- qradar-app-updated
NEW QUESTION 59
An administrator would like to categorize discovered assets by port definitions and add this information to a server type building block for further use.
Which QRadar Console functionality should the administrator use?
- A. Assets Tab - Server Discovery
- B. Assets Tab - Actions - Scan
- C. Admin Tab - Auto Update
- D. Admin - Scheduled Scans
Answer: A
Explanation:
Reference:
https://www.ibm.com/support/knowledgecenter/SS42VS_7.3.1/com.ibm.qradar.doc/ b_qradar_tuning_guide.pdf
NEW QUESTION 60
An administrator needs to import data into QRadar for a specific use case.
The data that has been provided to the administrator is stored in records that map a key to a value.
Which type of data collection must the administrator create?
- A. Reference map of sets
- B. Reference set
- C. Reference map of maps
- D. Reference map
Answer: A
Explanation:
Reference:
t_qradar_conifig_rul_resp_reference_set.html
NEW QUESTION 61
An administrator has to change the system hardware clock of the QRadar server. The administrator has already restarted the main services (hostservices, tomcat, hostcontext) and needs to synchronize the QRadar Console time with the QRadar managed hosts.
Which command can the administrator use to accomplish this?
- A. /sbin/hwclock -systohc /opt/qradar/bin/time_sync.sh
- B. /opt/qradar/support/all_servers.sh service ntpd restart
- C. /opt/qradar/support/all_servers.sh /opt/qradar/bin/time_sync.sh
- D. /opt/qradar/support/all_servers.sh systemctl restart systemd-timedated.service
Answer: C
Explanation:
Explanation/Reference: https://www.ibm.com/support/pages/qradar-configuring-ntp-settings-qradar-appliance
NEW QUESTION 62
......
IBM Security Fundamentals-C1000-026 Exam-Practice-Dumps: https://www.preppdf.com/IBM/C1000-026-prepaway-exam-dumps.html