C1000-026問題集、IBM実際の試験問題

質問 1

After fixing the assets that contributed to the asset growth deviation, an administrator needs to find the asset artifacts that have to be cleaned up.
What action should the administrator take to find the artifacts?

A. Run the ./cleanAssets.sh --list command

B. On the Asset tab, run the "Clean Assets" action

C. On the "Log Activity" tab, run the "Deviating Asset Growth: Asset Report event search"

D. On the Admin Tab, select System Configuration --> Asset Profiler Configuration

正解: C

解説: (PassTest メンバーにのみ表示されます)

質問 2

An administrator has reviewed the list of new features in the QRadar V7.3.2 release notes, and decides to upgrade their system to this version.
What is the minimum supported version that the administrator can upgrade from?

A. 7.3.1

B. 7.3.0

C. 7.2.6

D. 7.2.8

正解: C

質問 3

A QRadar user reported the following notification:
38750099 - The accumulator was unable to aggregate all events/flows for this interval When does this message appear?

A. When the aggregate data view configuration that is in memory is unable to write data to the database

B. When search results is unable to return over 200 unique objects

C. When the system is unable to accumulate data aggregations within 60 seconds

D. When aggregated data views are disabled

正解: C

質問 4

An administrator installed a new App Host and would like to move the existing applications from the Console to the App Host.
What steps should be performed?

A. Admin Tab > Extension Management > Click to change where apps are run

B. Admin Tab > System and License Management > Click to change where apps are run

C. Admin Tab > System Settings > Move apps

D. Admin Tab > Extension Management > Move apps

正解: B

質問 5

An administrator needs to add, delete and modify user accounts.
When deleting a user, what dependency checks are carried out?

A. Custom Rules, Security Profiles, Report and Search Criteria

B. Custom Rules, Report and Search Criteria, Historical Correlation Profiles

C. Custom Rules, Report and Search Criteria, Security Roles

D. Custom Rules, Historical Correlation Profiles, Security Profiles

正解: B

質問 6

An administrator needs to combine multiple extraction and calculation-based properties into a single property.
Which Ariel Query Language (AQL) statement can be used?

A. AQL functions and SELECT, FROM, or database names

B. AQL functions and AQL-based custom properties

C. AQL functions

D. AQL-based custom properties

正解: D

解説: (PassTest メンバーにのみ表示されます)

質問 7

An administrator is about to integrate logs from a custom firewall in a QRadar deployment using syslog. The SIEM has two domains, namely Domain A and Domain B.
While reviewing the following sample logs, the administrator notices a "context" keyword:
May 14 11:05:01 192.168.1.23 20190514 11:05:00 context=contextA permit 192.168.1.24 source:
10.10.1.15; source_port: 64094; destination: 10.10.13.34; service: 53; protocol: udp; May 13 12:07:01 192.168.1.23 20190513 11:07:00 context=contextB permit 192.168.1.25 source:
10.10.1.15; source_port: 64094; destination: 10.10.13.34; service: 53; protocol: udp; Which options assign the "contextA" logs to DomainA and the "contextB" logs to domain B? (Choose two.)

A. Create two individual log sources by configuring a separated logging instance for each context on the firewall and assign each log source to the correct domain.

B. Create two individual log sources using the context value as log source identifier and assign each log source to the correct domain.

C. Create a single log source, create a "Context" custom event property, and assign the log to both domains using a custom rule.

D. Create a single log source, create a "Context" custom event property, and assign the log to the correct domain using custom event property value.

E. Create a single log source, create a "Context" custom event property, and assign the log to the correct domain using a custom rule.

正解: A,B

IBM Security QRadar SIEM V7.3.2 Fundamental Administration - C1000-026 模擬練習