Verified C1000-026 dumps Q&As - 100% Pass from PrepPDF
Pass C1000-026 Exam in First Attempt Guaranteed 2021 Dumps!
Understanding functional and technical aspects of IBM Certified Associate Administrator - IBM QRadar Security Principles and Practices
The following will be discussed in IBM C1000-026 dumps:
- Plan and design QRadar deployment
- Monitor QRadar Notifications and error messages
- Review and interpret system monitoring dashboards
- Interpret the basic logs (e.g., qradar.error, qradar.log)
- Use the asset database
- Configure and manage retention policies (i.e., data and assets)
- Explain error messages and notifications
- Demonstrate knowledge of key commands to interpret QRadar services and processes
- Maintain configuration and data backups
- Implement and install QRadar
- Check system maintenance and health of appliances
- Plan QRadar upgrade and migration
- Create and manage saved searches, index, global views, dashboards and reports
- Monitor QRadar performance
- Configure event flow sources and custom properties
- Configure and apply network hierarchy
- Perform migration (e.g., backup and restore, import and export content)
- Create and administer users, user roles, and security profiles
- Deploy and manage applications and content packages
- Manage the license per allocation
- Create, review and modify rules, building blocks and reference sets
- Configure and manage domain and tenants
- Add Managed Hosts
- Monitor offenses and detect anomalies
- Configure global system notifications
- Review documentation and release notes
- Use embedded troubleshooting tools and scripts
- Perform QRadar updates, patches and upgrades
- Schedule and run a VA scan
- Use apps and tools for monitoring (e.g., QDI, assistant app, incident overview, DrQ)
- Verify QRadar processes and services
NEW QUESTION 11
An administrator is about to integrate logs from a custom firewall in a QRadar deployment using syslog. The SIEM has two domains, namely Domain A and Domain
B. While reviewing the following sample logs, the administrator notices a "context" keyword:
May 14 11:05:01 192.168.1.23 20190514 11:05:00 context=contextA permit 192.168.1.24 source: 10.10.1.15; source_port: 64094; destination: 10.10.13.34; service: 53; protocol: udp; May 13 12:07:01 192.168.1.23 20190513 11:07:00 context=contextB permit 192.168.1.25 source: 10.10.1.15; source_port: 64094; destination: 10.10.13.34; service: 53; protocol: udp; Which options assign the "contextA" logs to DomainA and the "contextB" logs to domain B? (Choose two.)
- A. Create two individual log sources by configuring a separated logging instance for each context on the firewall and assign each log source to the correct domain.
- B. Create a single log source, create a "Context" custom event property, and assign the log to the correct domain using custom event property value.
- C. Create a single log source, create a "Context" custom event property, and assign the log to the correct domain using a custom rule.
- D. Create a single log source, create a "Context" custom event property, and assign the log to both domains using a custom rule.
- E. Create two individual log sources using the context value as log source identifier and assign each log source to the correct domain.
Answer: A,E
NEW QUESTION 12
An administrator needs to develop advanced filters to retrieve information from the QRadar System pertaining to the top abnormal events of the most bandwidth-intensive IP addresses.
How can the administrator do this?
- A. Use the IBM DataStudio to create the query
- B. Build an AQL query using the QRadar GUI using Assets > Search Filter
- C. Combine GROUP BY and ORDER BY clauses in a single query
- D. Build an AQL query using the QRadar Scratchpad
Answer: C
Explanation:
Reference:
b_qradar_aql.pdf (21)
NEW QUESTION 13
An administrator would like to add a new managed host which uses an existing Network Address Translation (NAT).
Which parameters have to be provided if "Host is NATed" is chosen while adding a managed host?
- A. Select NATed network, Enter public IP of the server or appliance to add
- B. Select NATed network, Enter MAC address of the server or appliance to add
- C. Select Network Attached Telemetric, Enter public IP of the server or appliance to add
- D. Select Network Attached Telemetric, Enter MAC address of the server or appliance to add
Answer: A
Explanation:
Explanation/Reference: https://www.google.com/url?
sa=t&rct=j&q=&esrc=s&source=web&cd=1&ved=2ahUKEwihsu3Li5XmAhVYwAIHHeCLDtoQFjAAegQIBhAC& url=https%3A%2F%2Fwww.ibm.com%2Fdeveloperworks%2Fcommunity%2Fforums%2Fajax%2Fdownload%
2Fd5b20a5b-11bd-4a1d-b294-08ec138eb0e1%2F9d086dd8-eee9-4cbd-912d-26059ffdd0ca%
2FQRadar_721_AdminGuide.pdf&usg=AOvVaw1GO4OmOjWV7uiyCLrdE0FV
NEW QUESTION 14
Which IBM monitoring application can be used to see detailed health and status information at the application, middleware, and system level?
- A. QRadar Advisor With Watson App
- B. QRadar Operations App
- C. QRadar Deployment Intelligence App
- D. QRadar Assistant App
Answer: C
Explanation:
Reference:
https://www.ibm.com/support/knowledgecenter/en/SSKMKU/com.ibm.QDIapp.doc/ c_qapps_QDI_intro.html
NEW QUESTION 15
An administrator needs to know if a custom rule is being correlated correctly.
Which QRadar component is responsible for this process?
- A. QRadar Event Collector
- B. QRadar Console
- C. QRadar Event Processor
- D. Magistrate
Answer: C
Explanation:
Reference:
https://www.ibm.com/support/pages/qradar-global-correlation
NEW QUESTION 16
Which app should be used for monitoring QRadar performance and health?
- A. QRadar Performance Overview
- B. QRadar Extension Management
- C. QRadar Deployment Intelligence
- D. QRadar Monitoring Intelligence
Answer: C
Explanation:
Reference:
c_qapps_QDI_intro.html
NEW QUESTION 17
An administrator needs to add the following networks to a QRadar network hierarchy as a single Classless Inter-Domain Routin (CIDR) range:
192.168.64.0/24
192.168.65.0/24
192.168.66.0/24
192.168.67.0/24
What is the correct supernet for these subnets?
- A. Network 192.168.66.0 with subnet mask 255.255.252.0
- B. Network 192.168.66.0 with subnet mask 255.255.252.0
- C. Network 192.168.64.0 with subnet mask 255.255.252.0
- D. Network 192.168.64.0 with subnet mask 255.255.255.0
Answer: D
NEW QUESTION 18
A company has several appliances and the administrator needs to copy a file to all appliances to run some tests to verify the integrity of the processes. The /opt/qradar/support/all_servers.sh script can be used to issue commands to all QRadar appliances within the deployment.
What option must be used with the script to copy the file to all appliances in the deployment?
- A. /opt/qradar/support/all_servers.sh -p
- B. /opt/qradar/support/all_servers.sh -g
- C. /opt/qradar/support/all_servers.sh -C
- D. /opt/qradar/support/all_servers.sh -k
Answer: A
Explanation:
Explanation/Reference: https://www-01.ibm.com/support/docview.wss?uid=swg21998517
NEW QUESTION 19
A custom rule is generating events reporting that a specific user is failing to login too many times in the last 5 minutes. The administrator opens the event details to investigate the anomaly associated with the events but finds that no Anomaly details pane is shown.
What is the reason?
The events were generated by:
- A. a standard Custom Rule
- B. a Behavioral Detection Rule
- C. a Threshold Detection Rule
- D. an Anomaly Detection Rule
Answer: D
NEW QUESTION 20
An administrator has reviewed the list of new features in the QRadar V7.3.2 release notes, and decides to upgrade their system to this version.
What is the minimum supported version that the administrator can upgrade from?
- A. 7.3.0
- B. 7.3.1
- C. 7.2.6
- D. 7.2.8
Answer: C
Explanation:
Reference:
https://www.ibm.com/support/pages/release-qradar-v732-sfs-73220190201201121
NEW QUESTION 21
An administrator has been tasked to run all health checks at once using the DrQ command before a major event happens, such as an upgrade.
What does the DrQ command do?
- A. It shows all the available drives on the QRadar managed host.
- B. It runs all available checks in /opt/ibm/si/diagnostiq and writes the results in a txt file.
- C. It runs all available checks in /opt/ibm/si/diagnostiq with the checkup mode and with the summary output mode.
- D. It checks all the available drives on the QRadar managed host and writes the results on a txt file.
Answer: C
Explanation:
Reference:
https://www.ibm.com/support/knowledgecenter/en/SS42VS_7.3.2/com.ibm.qradar.doc/ t_drq_running_health_checks.html
NEW QUESTION 22
An administrator needs to collect logs from the Command Line Interface (CLI).
Which command should the administrator use?
- A. /opt/support/get_logs.sh
- B. /opt/qradar/support/get_logs.sh
- C. /opt/bin/qradar/support/get_logs.sh
- D. /opt/support/qradar/get_logs.sh
Answer: B
Explanation:
Reference:
https://www.ibm.com/support/pages/getting-help-what-information-should-be-submitted-qradarservice-request
NEW QUESTION 23
A QRadar user reported the following notification:
38750099 - The accumulator was unable to aggregate all events/flows for this interval When does this message appear?
- A. When the system is unable to accumulate data aggregations within 60 seconds
- B. When the aggregate data view configuration that is in memory is unable to write data to the database
- C. When search results is unable to return over 200 unique objects
- D. When aggregated data views are disabled
Answer: A
Explanation:
Reference:
https://www.ibm.com/support/knowledgecenter/SSKMKU/com.ibm.qradar.doc/38750099.html
NEW QUESTION 24
Which event routing rule is required to add QRadar Data Store (QDS) capability to a deployment?
- A. Bypass Correlation
- B. Delete data When storage space is required
- C. Log Only (exclude Analytics)
- D. Delete data immediately after the retention period has expired
Answer: C
Explanation:
Reference:
https://www.ibm.com/support/knowledgecenter/en/SS42VS_7.3.2/com.ibm.qradar.doc/ t_qradar_adm_data_store.html
NEW QUESTION 25
An administrator has been tasked to run all health checks at once using the DrQ command before a major event happens, such as an upgrade.
What does the DrQ command do?
- A. It shows all the available drives on the QRadar managed host.
- B. It runs all available checks in /opt/ibm/si/diagnostiq and writes the results in a txt file.
- C. It runs all available checks in /opt/ibm/si/diagnostiq with the checkup mode and with the summary output mode.
- D. It checks all the available drives on the QRadar managed host and writes the results on a txt file.
Answer: C
Explanation:
Reference:
t_drq_running_health_checks.html
NEW QUESTION 26
An administrator needs to complete the upgrade process from V7.3.1 to V7.3.2.
What is the correct procedure?
- A. Use the ISO file to execute the upgrade process
- B. Do a clean installation using the ISO file on a bootable USB device
- C. Copy the SFS file extension to the recommended directories and use this file
- D. Copy the ISO file extension to the recommended directories and use this file
Answer: C
Explanation:
Reference:
https://www.ibm.com/support/knowledgecenter/SS42VS_7.3.2/com.ibm.qradar.doc/ t_qradar_up_ugrad_sys.html
NEW QUESTION 27
An administrator would like to categorize discovered assets by port definitions and add this information to a server type building block for further use.
Which QRadar Console functionality should the administrator use?
- A. Assets Tab - Actions - Scan
- B. Admin - Scheduled Scans
- C. Assets Tab - Server Discovery
- D. Admin Tab - Auto Update
Answer: C
Explanation:
Explanation/Reference: https://www.ibm.com/support/knowledgecenter/SS42VS_7.3.1/com.ibm.qradar.doc/ b_qradar_tuning_guide.pdf
NEW QUESTION 28
An administrator may be asked to collect diagnostic information on one of our main services. For example, ecs-ec.
Commands such as:
/opt/qradar/support/thredtop.sh
/opt/qradar/support/jmx.sh
These commands collect thread and statistical information on the Services pipeline, queues and filters.
How would an administrator identify a list of jmx ports for each service?
- A. grep JMXPORT /opt/qradar/system/mem/*
- B. grep JMXPORT /opt/qradar/systemd/env/*
- C. grep JMXPORT /opt/qradar/init/*
- D. grep JMXPORT /opt/qradar/system/bin/*
Answer: B
NEW QUESTION 29
A QRadar upgrade is planned and a maintenance window is scheduled. The administrator must stage the FIXPACK from IBM Fix Central.
Which QRadar FIXPACK file type must the administrator download?
- A. IMG
- B. SFS
- C. XFS
- D. RPM
Answer: B
Explanation:
Reference:
20Security&product=ibm/Other+software/IBM+QRadar+Network
+Insights&release=7.3.0&platform=Linux&function=all
NEW QUESTION 30
To comply with specific regulations, an administrator has been requested to increase asset retention to 365 days.
In which QRadar section can the administrator find the asset retention settings?
- A. Admin Tab / Asset Retention
- B. Assets Tab / Retention settings
- C. Admin Tab / System settings
- D. Assets Tab / Asset Retention
Answer: C
Explanation:
Reference:
t_qradar_adm_asset_tuning_ip_retention.html
NEW QUESTION 31
When troubleshooting issues with QRadar applications, which application Docker container log file can be used to get more information about the apps?
- A. /var/log/qradar.log
- B. /var/log/qradar.error
- C. /var/log/app.log
- D. /store/log/app.log
Answer: D
Explanation:
Reference:
https://www.ibm.com/developerworks/community/wikis/home?lang=en#!/wiki/24f91a23-846b-483cba22-d78b95eed91e/page/d504c946-a9b0-4277-8e4f-bc554ac30e4e/versions
NEW QUESTION 32
......
C1000-026 Dumps Full Questions - Exam Study Guide: https://www.preppdf.com/IBM/C1000-026-prepaway-exam-dumps.html