Examice

Exam C1000-140 All QuestionsBrowse all questions from this exam

Question 6

What approach does QRadar take when it imposes EPS license (not hardware) limits on events that temporarily spike above that limit?

Excessive events in a spike cause a System Notification that advises the customer to increase their EPS license allocation.

QRadar EPS license allocation is implemented with a hard cutoff to ensure resources are not saturated.

During the spike, excess events are written to a queue, and they are processed after the EPS rate drops.

QRadar EPS licensing is measured as an average over a 24-hour period, which allows spikes to be handled gracefully.

Correct Answer: C

When QRadar encounters a temporary spike in events per second (EPS) that exceeds the licensed limit, it handles the excess events by writing them to a queue. These queued events are then processed once the EPS rate drops back within the licensed threshold. This approach ensures that no data is lost during spikes and that the system can handle temporary increases in event rates efficiently.

Discussion

elior19940Option: C

The right answer is C

mmonederoOption: C

C - https://www.ibm.com/docs/en/qsip/7.4?topic=management-burst-handling

mmonederoOption: C

C - During the spike, excess events are written to a queue, and they are processed after the EPS rate drops.