An administrator needs data backup. What information is contained in the data backup?

Question

Options

• AAudit log information, Event data, Flow data, Report data, Indexes, Log sources
• BAudit log information, Event data, Indexes, Index management information, Flow data, Report data
• CAudit log information, Event data, Flow data, Report data, Indexes
• DAudit log information, Event data, Indexes, Index management information, Flow data, Report

• A
  7% (3)
• B
  2% (1)
• C
  80% (35)
• D
  11% (5)

Explanation

Option C lists the exact five components included in a QRadar data backup: Audit log information, Event data, Flow data, Report data, and Indexes - nothing more, nothing less.

Why the distractors fail:

• A adds "Log sources," which belongs to a configuration backup, not a data backup.
• B adds "Index management information," which is also a configuration-level item, not stored in the data backup.
• D has two problems: it also includes "Index management information," and it truncates "Report data" to just "Report," making it factually incomplete.

Memory tip: Think of a data backup as capturing the raw collected data and its structure - events, flows, reports, audit logs, and the indexes that organize them. Anything that configures how QRadar operates (log sources, index management settings) lives in a configuration backup, not a data backup. The phrase "A-E-F-R-I" (Audit logs, Events, Flows, Reports, Indexes) can help you recall the five correct components.

No community discussion yet for this question.