IBM Security QRadar SIEM V7.2.6 Associate Analyst

Here you have the best IBM C2150-612 practice exam questions

Question 1 of 54

Where can a user add a note to an offense in the user interface?

Dashboard and Offenses Tab

Offenses Tab and Offense Detail Window

Offenses Detail Window, Dashboard, and Admin Tab

Dashboard, Offenses Tab, and Offense Detail Window

Correct Answer: B

Question 2 of 54

When might a Security Analyst want to review the payload of an event?

When immediately after login, the dashboard notifies the analyst of payloads that must be investigated

When "Review payload" is added to the offense description automatically by the "System: Notification" rule

When the event is associated with an active offense, the payload may contain information that is not normalized or extracted fields

When the event is associated with an active offense with a magnitude greater than 5, the payload should be reviewed, otherwise it is not necessary

Correct Answer: C

Question 3 of 54

Which key elements does the Report Wizard use to help create a report?

Layout, Container, Content

Container, Orientation, Layout

Report Classification, Time, Date

Pagination Option, Orientation, Date

Correct Answer: A

Question 4 of 54

How is an event magnitude calculated?

As the sum of the three properties Severity, Credibility and Relevance of the Event

As the sum of the three properties Severity, Credibility and Importance of the Event

As a weighted mean of the three properties Severity, Credibility and Relevance of the Event

As a weighted mean of the three properties Severity, Credibility and Importance of the Event

Correct Answer: C

Question 5 of 54

What is a benefit of using a span port, mirror port, or network tap as flow sources for QRadar?

These sources are marked with a current timestamp.

These sources show the ASN number of the remote system.

These sources show the username that generated the flow.

These sources include payload for layer 7 application analysis.

Correct Answer: D