最新的IBM Security Qradar SIEM Implementation v7.2.1 - C2150-400免費考試真題
What is used to collect netflow and jflow traffic in a QRadar Distributed Deployment?
正確答案: C
Assuming a Squid Proxy has logs in the following format:
Timeelapsed remotehost code/status bytes method URL rfc931 peerstatus/peerhost type And these are some sample logs from a Squid server:
Which regular expression would you use to pull out the bytes field into a custom property?
Timeelapsed remotehost code/status bytes method URL rfc931 peerstatus/peerhost type And these are some sample logs from a Squid server:
Which regular expression would you use to pull out the bytes field into a custom property?
正確答案: B
From the given event payload format:
You are tasked with creating a Reference Set of the second IPs in the payload.
What needs to be done to complete this task?
You are tasked with creating a Reference Set of the second IPs in the payload.
What needs to be done to complete this task?
正確答案: A
Which Permission Precedence should be applied to the users security profile assuming the administrators only want the group to have access to Windows events and flows and not events from other networks?
正確答案: B
Which two authentication methods for theQRadarUser Interface are valid? (Choose two.)
正確答案: B,E
A mail server typically communicates with 50 hosts per second in the middle of the night and then suddenly starts communicating with 1.000 hosts a second. The administrator wants to get an email alert whenever this situation is being observed.
Which type of rule should an administrator create to monitor this situation?
Which type of rule should an administrator create to monitor this situation?
正確答案: D
Which two proxy options are required to be set when using a Proxy Server for Auto Updates inQRadar? (Choose two.)
正確答案: A,B