最新的IBM C1000-018免費考試真題

問題1

When looking at Common rules, the parameters available to the tests refer to attributes of events and flows.
Which attributes are available?
Common rule tests can operate on:

A. all event attributes, but no flow attributes.

B. all flow attributes, but no event attributes.

C. a subset of the attributes of events and flows.

D. all attributes of events and flows.

正確答案: A

問題2

What are anomaly detection rules used for?

A. Detecting when unusual traffic patterns occur in the network.

B. Detecting volume changes that occur in regular patterns.

C. Detecting an activity that is greater or less than a specified range.

D. Detecting event traffic.

正確答案: B

問題3

An analyst had been researching an Offense that has now disappeared from the active Offense list.
What is the period of time that has to pass before an active Offense that receives no new contributing events or flows become inactive?

A. 1 hour

B. 3 days

C. 5 days

D. 24 hours

正確答案: C

說明：（僅 Fast2test 成員可見）

問題4

An analyst is noticing false positives from a single IP on a specific offense. How can the analyst tune the event rule to eliminate these false positives?

A. Add the rule test "AND NOT when the offense is indexed by one of the following IP addresses".

B. Add the rule test "AND when IP address equals" to the top of the test list of the rule.

C. Add the rule test "AND when IP address equals" to the bottom of the test list of the rule.

D. Add the rule test "AND NOT when IP address equals" to the bottom of the test list of the rule,

正確答案: D

問題5

What is required to create an anomaly rule?

A. triggered events

B. baseline anomalies

C. a grouped saved search

D. triggered flows

正確答案: A

問題6

An analyst needs to create a dashboard item that can be shared with other users. What is the main step in this process?

A. Create and share the search criteria that the dashboard Item will use.

B. Have users index the shared search criteria for reuse.

C. Ask the administrator to modify the shared search criteria and test the dashboard.

D. Enable a new custom dashboard and share it with users.

正確答案: D

問題7

An analyst working with QRadar SIEM has been assigned a new Offense and is preparing a custom report on the Offense summary page. From this page, the analyst wants to navigate to the Log Activity or Network Activity page to export the Event/Flow data (Action -> export to CSV).
How can the analyst do this? (Choose two)

A. Click the View Attack Path icon.

B. Click the Events / Flows icon.

C. Click the Summary icon.

D. In the Source IP(s) session, click the link to open the page.

E. In the Event/Flow count section, click the link to open the page.

正確答案: D,E

最新的IBM QRadar SIEM V7.3.2 Fundamental Analysis - C1000-018免費考試真題

聯系我們

站內鏈接

最新更新