EnsurePass
2017 Nov IBM Official New Released C2150-612
100% Free Download! 100% Pass Guaranteed!
http://www.EnsurePass.com/C2150-612.html

IBM Security QRadar SIEM V7.2.6, Associate Analyst

Question No: 1

What is the largest differentiator between a flow and event?

  1. Events occur at a moment in time while flows have a duration.

  2. Events can be forwarded to another destination, but flows cannot.

  3. Events allow for the creation of custom properties, but flows cannot.

  4. Flows only contribute to local correlated rules, while events are global.

Answer: A

Question No: 2

Which QRadar rule could detect a possible potential data loss?

  1. Apply 鈥淧otential data loss鈥?on event of flows which are detected by the local system and when any IP is part of any of the following XForce premium Premium_Malware

  2. Apply 鈥淧otential data loss鈥?on flows which are detected by the local system and when at least 1000 flows are seen with the same Destination IP and different source in 2 minutes

  3. Apply 鈥淧otential data loss鈥?on events which are detected by the local system and when the event category for the event is one of the following Authentication and when any of Username are contained in any of Terminated_User

  4. Apply 鈥淧otential data loss鈥?on flows which are detected by the local system and when the source bytes is greater than 200000 and when at least 5 flows are seen with the same Source IP, Destination Port Destination IP in 12 minutes

Answer: D

Question No: 3

Which key elements does the Report Wizard use to help create a report?

  1. Layout, Container, Content

  2. Container, Orientation, Layout

  3. Report Classification, Time, Date

  4. Pagination Option, Orientation, Date

Answer: A Explanation:

References:

IBM Security QRadar SIEM Users Guide. Page: 201

Question No: 4

Which kind of information do log sources provide?

  1. User login actions

  2. Operating system updates

  3. Flows generated by users

  4. Router configuration exports.

Answer: A

Question No: 5

Which list is only Rule Actions?

  1. Modify Credibility; Send SNMP trap; Drop the Detected Event; Dispatch New Event.

  2. Modify Credibility; Annotate Event; Send to Forwarding Destinations; Dispatch New Event.

  3. Modify Severity; Annotate Event; Drop the Detected Event; Ensure the detected event is part of an offense.

  4. Modify Severity; Send to Forwarding Destinations; Drop the Detected Event; Ensure the detected event is part of an offense.

Answer: A Explanation: References:

http://www.ibm.com/support/knowledgecenter/SSKMKU/com.ibm.qradar.doc/t_qradar_crea te_cust_rul.html

Question No: 6

Where are events related to a specific offense found?

  1. Offenses Tab and Event List window

  2. Dashboard and List of Events window

  3. Offense Summary Page and List of Events window

  4. Under Log Activity, search for Events associated with an Offense

Answer: A

Question No: 7

What are the various timestamps related to a flow?

  1. First Packet Time, Storage Time, Log Source Time

  2. First Packet Time, Storage Time, Last Packet Time

  3. First Packet Time, Log Source Time, Last Packet Time

  4. First Packet Time, Storage Time, Log Source Time, End Time

Answer: B Explanation: References:

IBM Security QRadar SIEM Users Guide. Page: 101

Question No: 8

What is indicated by an event on an existing log in QRadar that has a Low Level Category of 鈥淯nknown鈥?

  1. That event could not be parsed

  2. That event arrived out of order from the original device

  3. That event was from a device that is not supported by QRadar

  4. That the event was parsed, but not mapped to an existing QRadar category

Answer: D Explanation: References:

https://www.ibm.com/support/knowledgecenter/SSKMKU/com.ibm.dsm.doc/c_DSM_guide_ UniversalLEEF_eventmap.html#c_dsm_guide_universalleef_eventmap

Question No: 9

When using the right click event filtering functionality on a Source IP, one can filter by 鈥淪ource IP is not [*]鈥?

Which two other filters can be shown using the right click event filtering functionality? (Choose two.)

  1. Filter on DNS entry [*]

  2. Filter on Source IP is [*]

  3. Filter on Time and Date is [*]

  4. Filter on Source or Destination IP is [*]

  5. Filter on Source or Destination IP is not [*]

Answer: B,D

Question No: 10

Which pair of options are available in the left column on the Reports Tab?

  1. Reports and Owner

  2. Reports and Branding

  3. Reports and Report Grouping

  4. Reports and Scheduled Reports

Answer: B

100% Free Download!
Download Free Demo:C2150-612 Demo PDF
100% Pass Guaranteed!
Download 2017 EnsurePass C2150-612 Full Exam PDF and VCE

EnsurePass ExamCollection Testking
Lowest Price Guarantee Yes No No
Up-to-Dated Yes No No
Real Questions Yes No No
Explanation Yes No No
PDF VCE Yes No No
Free VCE Simulator Yes No No
Instant Download Yes No No

2017 EnsurePass IT Certification PDF and VCE