Nest 0 Cart
Nest Account
Popular Exams
All Categories...
Nest
Nest 0
Contact
Log In / Sign Up
Copyright 2024 © store. All rights reserved.
Home IBM C2150-624

IBM C2150-624 Exam Practice Questions (P. 2)

  • Full Access (60 questions)
  • Six months of Premium Access
  • Access to one million comments
  • Seamless ChatGPT Integration
  • Ability to download PDF files
  • Anki Flashcard files for revision
  • No Captcha & No AdSense
  • Advanced Exam Configuration
Get Contributor Access
Question #6
An Administrators will add a secondary host to an IBM Security QRadar SIEM V7.2.8 Console in a High Availability (HA) deployment scenario.
After checking the compatibility between primary and secondary HA pairs, what other prerequisite should the Administrator check within Managed Interfaces?
  1. A
    The shared external storage.
  2. B
    The server certificate that is issued by the local CA.
  3. C
    The existence of an additional distributed file system.
  4. D
    The communication for Distributed Replicated Block Device.

Correct Answer:
D
CP port 7789 must be open and allow communication between the primary and secondary for Distributed Replicated Block Device (DRBD) traffic.
DRBD traffic is responsible for disk replication and is bidirectional between the primary and secondary host.

Reference -
https://www.ibm.com/support/knowledgecenter/SS42VS_7.2.7/com.ibm.qradar.doc/c_qradar_appliance_require.html

Question #7
An Administrator working with IBM Security QRadar SIEM V7.2.8 needs to delete a single value named User1 from a reference set with the name "Allowed Users" from the command line interface.
Which command will accomplish this?
  1. A
    ./UtilReferenceSet.sh purge "Allowed Users" User1
  2. B
    ./ReferenceSetUtil.sh purge "Allowed Users" User1
  3. C
    ./ReferenceSetUtil.sh delete "Allowed\ Users" User1
  4. D
    ./UtilReferenceSet.sh delete "Allowed\ Users" User1

Correct Answer:
B
The Referencesetutil.sh purge is the correct syntax of the command. It deletes the specific user when you mention it within the reference set.

Reference -
https://www.ibm.com/developerworks/community/forums/html/topic?id=77777777-0000-0000-0000-000014967953

Question #8
When it comes to licensing, what is the difference between Events and Flows and how they are licensed?
  1. A
    Flows are licensed based on overall count over a minute, where Events are licensed based on overall count per second.
  2. B
    Flows are licensed based on overall count per second, where Events are licensed based on overall count over a minute.
  3. C
    Flows and Events are both licensed by overall count per minute under an Upgraded License and per second on a Basic License.
  4. D
    Flows and Events are both licensed by overall count per second under an Upgraded License and per second on a Basic License.

Correct Answer:
A
A significant difference between event and flow data is that an event, which typically is a log of a specific action such as a user login, or a VPN connection, occurs at a specific time and the event is logged at that time. A flow is a record of network activity that can last for seconds, minutes, hours, or days, depending on the activity within the session. For example, a web request might download multiple files such as images, ads, video, and last for 5 to 10 seconds, or a user who watches a Netflix movie might be in a network session that lasts up to a few hours. The flow is a record of network activity between two hosts.

Reference -
https://www.ibm.com/support/knowledgecenter/en/SS42VS_7.2.8/com.ibm.qradar.doc/c_qradar_deploy_event_and_flow_pipeline.html

Question #9
When an IBM Security QRadar SIEM V7.2.8 distributed deployment requires scaling horizontally to achieve Event per Second (EPS) requirements, what QRadar
Component needs to be added to meet the EPS demands?
  1. A
    Event Manager
  2. B
    Event Indexing
  3. C
    Event Collector
  4. D
    Event Processor

Correct Answer:
D
The QRadar SIEM Event Processor Virtual 1699 appliance supports the following items:
✑ Up to 10,000 events per second
✑ 2 TB or larger dedicated event storage

Reference -
https://www.ibm.com/support/knowledgecenter/SS42VS_7.2.4/com.ibm.qradar.doc_7.2.4/c_siem_vrt_ap_ov.html

Question #10
The event data collected by IBM Security QRadar SIEM V7.2.8 is being deleted after one month. The legal department required the data be kept for two months.
What can the administrator do to accommodate this requirement?
  1. A
    Change the nightly backup Priority to "High".
  2. B
    Change the nightly backup to a monthly backup.
  3. C
    Change the Default Event Retention Policy property field "Do not delete data in this bucket" to two months.
  4. D
    Change the Default Event Retention Policy property field "Keep data placed in this bucket for" to two months.

Correct Answer:
C
When storage space is required - Select this option if you want events or flows that match the Keep data placed in this bucket for parameter to remain in storage until the disk monitoring system detects that storage is required. If used disk space reaches 85% for records and 83% for payloads, data will be deleted. Deletion continues until the used disk space reaches 82% for records and 81% for payloads.
When storage is required, only events or flows that match the Keep data placed in this bucket for parameter are deleted.

Reference -
https://www.ibm.com/developerworks/community/forums/atom/download/Event_Flow_Retention_QRadar_72_AdminGuide.pdf?nodeId=593f2b31- a858-4210-b380-4674894a6ad9

Previous Questions Next Questions

All Pages