C1000-162 Leak Questions

IBM Security QRadar SIEM V7.5 Analysis Questions and Answers

Question 9

How long will an AQL statement remain in execution if a time criteria is not specified, such as start, end, or last?

30 minutes

10 minutes

15 minutes

5 minutes

Question 10

From the Offense Summary window, how is the list of rules that contributed to a chained offense identified?

Select Display > Notes

Select Actions > Rules

Select Display > Rules

Listed in the notes section

Question 11

A mapping of a username to a user’s manager can be stored in a Reference Table and output in a search or a report.

Which mechanism could be used to do this?

Quick Search filters can select users based on their manager’s name.

Reference Table lookup values can be accessed in an advanced search.

Reference Table lookup values can be accessed as custom event properties.

Reference Table lookup values are automatically used whenever a saved search is run.

Question 12

How can an analyst identify the top rules that generated offenses in the previous week and were closed as false positives or tuned?

From Reports > Offenses Report > Weekly reports > False positives reports

Use Case Manager app > Active Rules > Filter Offenses with start date > Closure Reason > Select False-Positive, Tuned

Use Case Manager app > CRE Report > Filter Offenses with the following direction > R2R > Select False-Positive, Tuned.

From Reports > CRE Report > Weekly reports > False positives reports