[Jan-2022] Use Real C1000-055 Dumps - 100% Free C1000-055 Exam Dumps
C1000-055 PDF Dumps Exam Questions – Valid C1000-055 Dumps
IBM C1000-055 Exam Syllabus Topics:
| Topic | Details |
|---|---|
| Topic 1 |
|
| Topic 2 |
|
| Topic 3 |
|
| Topic 4 |
|
| Topic 5 |
|
NEW QUESTION 11
A deployment professional needs to find out which rules are generating most of the offenses. What should the deployment professional do? (Choose two)
- A. Offenses -> By Category
- B. Offenses -> Rules -> Sort by Offense Count
- C. Use search where Log source is Health Metrics-2 :: <qradar hostname> and choose Grouping by Event Name
- D. Generate Report "System Summary"
- E. Use search where Log source is Custom Rule Engine-8 :: <qradar hostname> and choose Grouping by Event Name
Answer: B,D
NEW QUESTION 12
A deployment professional decides to improve visibility in the network and successfully installs the Flow Collector.
What should the deployment professional connect the Flow Collector to?
- A. SPAN port
- B. SAN port
- C. WAN port
- D. LAN port
Answer: A
NEW QUESTION 13
A deployment professional is creating an architecture for a customer who has locations which regularly go out of contact with the rest of the network. The requirement is to receive logs locally and then have a scheduled connection to QRadar to upload the events.
Which QRadar appliances should be deployed in these locations?
- A. 15xx Event Collector with a Store and Forward schedule
- B. 31 xx All-in-One with Online Forwarding configured
- C. 16xx Event Processor with a Store and Forward schedule
- D. Disconnected Log Collector with UDP configured
Answer: C
NEW QUESTION 14
A deployment professional needs to configure network devices to send IPFIX to a QRadar deployment consisting of 1 QRadar Console 3129 and 2 QRadar Event Processors 1629. The routers will send more than 1
000 000 FPM.
Which component should be added to the existing deployment?
- A. AppHost
- B. Event Collector
- C. DataNode
- D. Flow Processor
Answer: B
NEW QUESTION 15
A deployment professional has been asked to ensure that the system has access to information which can be used by rules to acquire information extracted from a user information source such as Active Directory or LDAP.
Which information repository should the deployment professional store this data in?
- A. Reference Data
- B. Ariel Database
- C. Docker containers
- D. Asset profiles
Answer: C
NEW QUESTION 16
An application developer is working on a reporting tool that fetches and visualizes data from multiple data sources. The deployment professional is asked to explain how to make authenticated requests on QRadar using its REST API interface.
Which authentication method is supported by QRadar's REST API?
- A. Authorization token in an HTTP header
- B. Authorization token in an LTPA token
- C. Authorization token in an HTTP query string
- D. Authorization token in an JWT token
Answer: D
NEW QUESTION 17
A deployment professional needs to configure the IBM QRadar systems so that data is forwarded to one or more vendor systems, such as ticketing or alerting systems.
Which event format options can the deployment professional use for forwarding destination configuration?
- A. leef, json and cef
- B. normalized, json and cef
- C. payioad, normalized and json
- D. json, cef and payload
Answer: B
NEW QUESTION 18
Some customers do not fully understand the benefits of using dedicated appliances to collect events and flows, complaining about the complexity of the deployments.
How should the deployment professional clarify any doubts that may arise?
- A. Event Processor collect events from various log sources and continuously forwards these events to an Event Collector.
- B. The operation of the QRadar security intelligence platform consists of three layers, and applies to any QRadar deployment structure, regardless of its size and complexity.
- C. Using All-in-One appliances are a good choice for environments greater than 100.000 EPS.
- D. Dedicated event collectors when deployed in VMs include an on-board event processor that can be directly attached to an All-in-One Virtual console type 3199.
Answer: C
NEW QUESTION 19
A deployment professional needs to create a SIEM architecture plan. The deployment professional needs to consider applying a set of security policies (or questions) about the client's network and monitor the policies for changes. It is important also to query all network connections, compare device configurations, filter the network topology, and simulate the possible effects of updating device configurations.
Which component can be added to the deployment to meet this security business objective?
- A. QRadar Vulnerability Manager
- B. QRadar Incident Forensics
- C. QRadar Network Insights
- D. QRadar Risk Manager
Answer: A
NEW QUESTION 20
A customer has a Network Vulnerability Scanner which is not supported by IBM QRadar.
How can a deployment professional integrate such a scanner with IBM QRadar?
- A. By creating a Log Source Extension (LSX)
- B. Creating a uDSM using the DSM Editor
- C. Using the AXIS Scanner option of IBM QRadar
- D. Using a Custom Flow Source
Answer: C
NEW QUESTION 21
A customer needs to increase the storage space that is available to an Event Processor and be able to speed up historical searches.
Which solution should the deployment professional recommend?
- A. Add an Event Collector to the Event Processor
- B. Expand the storage space on the Event Processor using LVM
- C. Connect additional External Storage to the Event Processor
- D. Connect a Data Node to the Event Processor
Answer: B
NEW QUESTION 22
A deployment professional configures domain definitions for events in a multi-tenant QRadar environment.
The domain assignments for tenants, flows, VA scanners, reference data, network hierarchy items are already configured.
Which is the order of precedence between the incoming event's attributes when evaluating its domain assignment?
- A. Tenant, Network Hierarchy. Log Source, Event Collector
- B. Tenant, Log Source, Network Hierarchy, Log Source Group
- C. Custom Properties, Network Hierarchy, Log Source, Event Collector
- D. Custom Properties, Log Source, Log Source Group. Event Collector
Answer: A
NEW QUESTION 23
A deployment professional found the System Activity Reporting (SAR) notifications alert "Performance degradation was detected in the event pipeline. Expensive DSM extensions were found". From the Log Sources under date creation, it can be seen that a new DSM was installed by another team member today.
To troubleshoot this issue, what steps can the deployment professional take? (Choose two)
- A. Ensure that the log source extension is applied to all of the log sources.
- B. Order your log source parsers from the log sources with the most sent events to the least and disable unused parsers.
- C. Review the debug file /var/log/qradar.dsm.debug
- D. Run the DSM Editor and select Optimize over DSM payload to correct this error.
- E. Review the payload of the notification to determine which expensive DSM extension in the pipeline affects performance.
Answer: E
NEW QUESTION 24
A deployment professional configures QRadar auto-update with the automatic install option for all update types where automatic install is available.
Assuming all auto-update installations are successful, which update types will need manual installation?
- A. Major updates, scanner and protocol updates
- B. Configuration updates and WinCollect updates
- C. Application updates and major updates
- D. Application updates, DSM, scanner and protocol updates
Answer: D
NEW QUESTION 25
A deployment professional is notified that event and flow data that are sent to the All-in-One are not processing. However, there is no issue with the existing data.
What should the deployment professional investigate?
- A. Check the connection between Console and the Event Processor.
- B. Check to see if the Event Collector license is expired.
- C. Check the connection between All-in-One and the X-Force.
- D. Check to see if the All-in-One license is expired.
Answer: B
NEW QUESTION 26
A deployment professional sees that there are occasional spikes in the EPS (Events per second). The host has
1000 EPS allocated but the occasional spikes go up to 1185 EPS.
What happens with the events when they go over the allocated amount?
- A. Events are dropped.
- B. Events are shown normally, but no offenses are generated.
- C. Events are shown normally, QRadar has 20% buffer.
- D. Events are moved to a temporary queue.
Answer: D
NEW QUESTION 27
A deployment professional is about to execute Server Discovery to populate the Host Definition Building Blocks. The deployment professional is working in a monitored environment and does not wish to set off any network scanner alarms.
What step should the deployment professional take to ensure that good results are returned and that no alarms are raised?
- A. Warn the network monitoring team that QRadar is about to run a network port scan
- B. Ensure that the flow sources are configured correctly and collecting data
- C. Set the 'Passive discovery' flag in Advanced System Settings in the Admin tab
- D. Ensure that events from the relevant servers are being collected successfully
Answer: C
NEW QUESTION 28
A deployment professional has to decide where data will be stored in a newly configured environment to submit a plan for storage and network connectivity bandwidth.
Which QRadar components within a deployment can store raw or normalized events locally? (Choose two)
- A. Data Node
- B. Flow Collector
- C. Event Processor
- D. Event Collector
- E. Data Diode
Answer: A,C
Explanation:
Explanation
https://www.ibm.com/docs/en/SS42VS_7.3.3/com.ibm.qradar.doc/b_siem_deployment.pdf
NEW QUESTION 29
IBM Security QRadar initiates a sequence of events when a primary high-availability (HA) host fails. During failover, the secondary HA host assumes the responsibilities of the primary HA host. The following actions are completed.
1.1. If configured, external shared storage devices are detected and the file systems are mounted.
2. 2. The secondary HA host connects to the console and downloads configuration files.
3. 3. A management interface network alias is created, for example, the network alias for ethO is ethO:0.
4. 4. The cluster virtual IP address is assigned to the network alias.
5. 5. All QRadar services are started.
What is the order of the sequence?
- A. 1,4,5,3,2
- B. 1,4,3,2,5
- C. 1.2,3,4,5
- D. 1,3,4,5.2
Answer: C
NEW QUESTION 30
A QRadar customer has a custom log source. The deployment professional has already created a custom DSM for the log source and all incoming events are correctly parsed and mapped to a QID. Now, in addition to the currently parsed properties, the customer requires that the information about the last logged in user is recorded in the asset database.
How can the deployment professional fulfill the requirement?
- A. Use the DSM editor to create an expression for the Identity Username property and make sure it parses correctly. It is automatically applied to all events with low level category "User login success".
- B. Use the DSM editor to create an expression for the Username property so it is correctly parsed. Create an expression for any available identity property and make sure it is correctly parsed. It is automatically applied to all events with low level category "User login success".
- C. Use the DSM editor to ensure that the Identity Username property is correctly parsed. Create an expression for any available identity property and ensure it is correctly parsed. Also, in the DSM editor enable identity data for the login success event type.
- D. Use the DSM editor to ensure that the Username property is correctly parsed. Create an expression for any available identity property and ensure it is correctly parsed. Also, in the DSM editor, enable the identity data for the login success event type.
Answer: A
NEW QUESTION 31
A deployment professional needs to clear out the Asset Database in IBM QRadar. Which service on the Console is restarted when script cleanAssetModel.sh is executed?
- A. Tomcat
- B. Hostservices
- C. PostgressDB
- D. Hostcontext
Answer: B
NEW QUESTION 32
A deployment professional is working on integrating an unsupported log source. The log source is able to send events in multiple formats. The administrators of the log source ask which event format should be configured.
Which event format should the deployment professional choose to be able to use direct parsing support in QRadar's DSM editor?
- A. SAML
- B. Regex
- C. BLOB
- D. LEEF
Answer: C
NEW QUESTION 33
A deployment professional needs to implement a crossover cable in the high availability (HA) environment.
By doing so, this QRadar deployment isolates what kind of traffic over the crossover connection?
- A. HA replication
- B. flow
- C. event
- D. query
Answer: C
NEW QUESTION 34
......
Ultimate C1000-055 Guide to Prepare Free Latest IBM Practice Tests Dumps: https://dumpstorrent.dumpsking.com/C1000-055-testking-dumps.html
