C1000-026 Exam Questions
70 real C1000-026 exam questions with expert-verified answers and explanations. Page 1 of 2.
- Question #1Offense Management and Troubleshooting
An administrator logs in to the Offenses tab and finds a large number of new Offenses that need action. What column in the list of Offenses should the administrator use to prioriti...
offense prioritizationmagnitudeoffense management - Question #2Rule and Report Management
An administrator receives an expensive custom rule notification. Which tool can now be enabled via the Advanced `System Settings' ?Custom Rule Settings to help troubleshoot this?
custom rule performancerule analysisadvanced system settingstroubleshooting - Question #3QRadar SIEM Architecture and Components
An administrator enters the QRadar web console into a web browser but does not get a response. Which process is responsible for the QRadar GUI?
QRadar GUItomcatweb consoleprocess management - Question #4System Administration and Configuration
What happens if QRadar receives events at a higher rate than the license allows?
license limitsevent rateevent queuingcapacity management - Question #5System Administration and Configuration
An administrator would like to add a new managed host which uses an existing Network Address Translation (NAT). Which parameters have to be provided if "Host is NATed" is chosen wh...
managed hostNAT configurationnetwork address translationdeployment - Question #6System Administration and Configuration
An administrator is tasked to reduce data volumes in the asset database and reduce stale data contributing to asset growth deviation. How can the administrator tune the configurati...
asset profilerasset databasedata retentionasset growth deviation - Question #7System Administration and Configuration
An administrator would like to extend the functionality of QRadar using an external application. Which file format is supported to successfully upload an application from the QRada...
QRadar extensionsapp uploadfile formatextension management - Question #8Rule and Report Management
An administrator needs to save a search to use it in the dashboards. To do so, which search feature does the administrator need to select in the "Include in my Dashboard" checkbox?
saved searchdashboardsearch configurationgrouped search - Question #9System Administration and Configuration
An administrator logs into the QRadar Console to review the stored backup files. There is an exclamation mark beside some files. What is the cause of this?
backup managementmissing backup filesbackup status indicators - Question #10System Administration and Configuration
An administrator needs data backup. What information is contained in the data backup?
data backupbackup contentsevent dataflow data - Question #11System Administration and Configuration
A QRadar upgrade is planned and a maintenance window is scheduled. The administrator must stage the FIXPACK from IBM Fix Central. Which QRadar FIXPACK file type must the administra...
FIXPACKSFS file formatupgrade managementIBM Fix Central - Question #12System Administration and Configuration
An administrator installed a new App Host and would like to move the existing applications from the Console to the App Host. What steps should be performed?
App Hostapplication migrationsystem and license managementextension management - Question #13System Administration and Configuration
An administrator needs to restore from backup the applications in QRadar. Which configuration item should the administrator select?
backup restoreapplication restoreinstalled applications configuration - Question #14Offense Management and Troubleshooting
When troubleshooting issues with QRadar applications, which application Docker container log file can be used to get more information about the apps?
Docker container logsapplication troubleshootinglog file pathsQRadar apps - Question #15System Administration and Configuration
An ip_context_menu.xml plug-in was created to assist in finding additional details for selected lP addresses. Where must this file be placed so the plug-in can be used?
XML pluginip_context_menuwebpluginsfile placement - Question #16System Administration and Configuration
SCSI can be configured in a standard IBM Security Qradar SIEM V7.1 deployment or in a High Availability environment. The initiator name is used to identify the iSCSI device volume...
iSCSIinitiator namestorage configurationfile path - Question #17Rule and Report Management
Which action must be performed prior to adding a new chart or table to a dashboard?
dashboardsaved searchgrouped searchchart management - Question #18System Administration and Configuration
Where in the Admin tab are hashing algorithms turned on for events and flows?
hashing algorithmsevent integrityflow integritysystem settings - Question #19Rule and Report Management
An administrator needs to import data into QRadar for a specific use case. The data that has been provided to the administrator is stored in records that map a key to a value. Whic...
reference map of setsreference datakey-value mappingdata import - Question #20QRadar SIEM Architecture and Components
An administrator needs to know if a custom rule is being correlated correctly. Which QRadar component is responsible for this process?
custom rule correlationevent processorrule processingQRadar components - Question #21System Administration and Configuration
A QRadar administrator added High Availability (HA) to the Event Processor and needs to verify the crossover link status between the primary and secondary hosts. Which commands can...
High Availabilitycrossover linkHA statusCLI commands - Question #22Rule and Report Management
Which event routing rule is required to add QRadar Data Store (QDS) capability to a deployment?
QRadar Data Storeevent routinglog only ruleanalytics bypass - Question #23Log Source and Network Activity Configuration
An administrator is seeing the following system notification: 38750057 - A protocol source configuration may be stopping events from being collected. What is a valid user action to...
system notificationsprotocol sourceevent collectiontroubleshooting logs - Question #24System Administration and Configuration
An administrator needs to import a list of HR staff logins into a reference set. Which file type can be used with the import function in the reference set editor window?
reference setimportCSVdata import - Question #25System Administration and Configuration
Which configuration is required to create a successful High Availability cluster?
High AvailabilityHA clusterprimary secondaryappliance configuration - Question #26Log Source and Network Activity Configuration
When an administrator attempts to edit a log source after upgrading QRadar, a Device Support Module (DSM), a protocol, or Vulnerability Information Services (VIS) components, the f...
DSM upgradelog source edittomcatbrowser cache - Question #27QRadar SIEM Architecture and Components
What is the minimum memory in gigabyte (GB) required for a QRadar All-in-One Virtual 3199 appliance?
virtual appliancememory requirementsAll-in-Onehardware specs - Question #28Offense Management and Troubleshooting
An administrator needs to develop advanced filters to retrieve information from the QRadar System pertaining to the top abnormal events of the most bandwidth-intensive IP addresses...
AQLGROUP BYORDER BYbandwidth analysis - Question #29System Administration and Configuration
An administrator needs to save the nightly QRadar backups on a network storage. The administrator has established the connection to the network storage. What should the administrat...
backupnetwork storagebackup repositorybackup recovery - Question #30System Administration and Configuration
An administrator needs to collect logs from the Command Line Interface (CLI). Which command should the administrator use?
CLIlog collectionsupport scriptsget_logs - Question #31System Administration and Configuration
To comply with specific regulations, an administrator has been requested to increase asset retention to 365 days. In which QRadar section can the administrator find the asset reten...
asset retentionsystem settingscomplianceretention period - Question #32Log Source and Network Activity Configuration
An administrator is about to integrate logs from a custom firewall in a QRadar deployment using syslog. The SIEM has two domains, namely Domain A and Domain B. While reviewing the...
multi-domainlog source identifiersyslogcontext keyword - Question #33Log Source and Network Activity Configuration
An administrator plans to deploy multiple log sources that share a common configuration. How many log sources can be added at one time?
bulk log sourcelog source configurationdeploymentbatch add - Question #34Log Source and Network Activity Configuration
An administrator needs to add the following networks to a QRadar network hierarchy as a single Classless Inter-Domain Routin (CIDR) range: 192.168.64.0/24 192.168.65.0/24 192.168.6...
network hierarchyCIDRsupernetsubnet mask - Question #35System Administration and Configuration
Due to regulatory constraints, an administrator must increase the minimum password length and complexity. In which QRadar section can the administrator change this setting?
password policycomplexityregulatory complianceauthentication - Question #36System Administration and Configuration
Which log should be reviewed to determine the reasons a patch installer did not proceed during a QRadar upgrade?
patch installerupgrade logstroubleshootingpatches.log - Question #37QRadar SIEM Architecture and Components
An administrator has added a new Event Processor to a QRadar deployment. How many events per second (EPS) are granted from the temporary license and how many days will those EPS la...
temporary licenseEPSEvent Processorlicense period - Question #38QRadar SIEM Architecture and Components
How many default dashboards does QRadar have?
dashboarddefault dashboardsQRadar UIconsole - Question #39System Administration and Configuration
An administrator needs to upgrade their QRadar environment. The administrator has downloaded the Patchupdate File from Fixcentral and transferred this Image to the Appliance. Which...
upgradepatch updatesquashfsmount command - Question #40System Administration and Configuration
An administrator has to change the system hardware clock of the QRadar server. The administrator has already restarted the main services (hostservices, tomcat, hostcontext) and nee...
hardware clocktime synchronizationmanaged hoststime_sync - Question #41Rule and Report Management
An administrator has been tasked to create a saved search that shows a list of multiple login failures for a single user by username. The administrator has done the following: 1. S...
saved searchcustom rule filterauthentication eventsusername grouping - Question #42Log Source and Network Activity Configuration
An administrator needs to extract a property from an intrusion detection system (IDS) log. Using a regular expression, the administrator wants to extract a specific part of the log...
custom event propertyregex extractionlog parsingIDS logs - Question #43Rule and Report Management
A company has two different domains in their IBM QRadar system: Domain_A and Domain_B. An administrator has been tasked to create a rule to look only at events that are tagged with...
domain filteringrule conditionsmulti-domainevent tagging - Question #44Log Source and Network Activity Configuration
Once a QID is created how is it associated with an event?
QID mappingevent categorizationlog source mapping - Question #45Log Source and Network Activity Configuration
How would an IBM Security QRadar administrator know if asymmetric superflows are enabled?
asymmetric superflowsQFlow CollectorDeployment Editorflow configuration - Question #46System Administration and Configuration
A company has several appliances and the administrator needs to copy a file to all appliances to run some tests to verify the integrity of the processes. The /opt/qradar/support/al...
all_servers.shfile copydeployment managementCLI options - Question #47System Administration and Configuration
An administrator enabled the base license of QRadar Vulnerability Manager. How many assets can be scanned using this license?
QRadar Vulnerability Managerbase licenseasset scanninglicensing - Question #48System Administration and Configuration
An administrator needs to add, delete and modify user accounts. When deleting a user, what dependency checks are carried out?
user account managementdependency checkshistorical correlationuser deletion - Question #49System Administration and Configuration
An administrator needs to complete the upgrade process from V7.3.1 to V7.3.2. What is the correct procedure?
QRadar upgradeSFS fileversion migrationupgrade procedure - Question #50QRadar SIEM Architecture and Components
An administrator would like to categorize discovered assets by port definitions and add this information to a server type building block for further use. Which QRadar Console funct...
asset discoveryserver type building blockport definitionsserver discovery