IBM
A2150-195 · Question #46
Everyone involvedin a forensic analysis is now convinced that account management events involving promotion of accounts to AD administrator groups must be reported on daily. What is the most…
The correct answer is C. The detailed search that the user has used to identify the relevant events must be saved. See the full explanation below for the reasoning.
Question
Everyone involvedin a forensic analysis is now convinced that account management events involving promotion of accounts to AD administrator groups must be reported on daily. What is the most efficient method to accomplish this in IBM Security QRadar V7.0 MR4 (QRadar)?
Options
- ASuch a report requires additional parsing of events using extra custom properties and then
- BA new rule must be created which triggers an offense every time an account is assigned
- CThe detailed search that the user has used to identify the relevant events must be saved
- DAutomation or scripting is out of the question.
How the community answered
(68 responses)- A3% (2)
- B7% (5)
- C72% (49)
- D18% (12)
Community Discussion
No community discussion yet for this question.