An administrator needs to import data into QRadar for a specific use case. The data that has been provided to the administrator is stored in records that map a key to a value. Which type of data…

Question

Options

• AReference set
• BReference map of sets
• CReference map
• DReference map of maps

• A
  6% (2)
• B
  77% (27)
• C
  14% (5)
• D
  3% (1)

Explanation

Important note: The marked answer (B) appears to be incorrect based on standard QRadar definitions. The correct answer for this question should be C. Reference map.

A reference map is specifically designed to store key-to-value pairs - each unique key maps to exactly one value (e.g., IP address → username). This directly matches the question's description of "records that map a key to a value."

Why the distractors are wrong:

• A. Reference set - stores a flat list of individual values with no key-value structure at all.
• B. Reference map of sets - maps a key to multiple values (a set), meaning one key → many values; this is for one-to-many relationships, not simple key-to-value pairs.
• D. Reference map of maps - maps an outer key to an inner map of key-value pairs (two-dimensional key lookup), which is more complex than what the question describes.

Memory tip: Match the structure to the cardinality. Key → one value = Reference Map. Key → many values = Reference Map of Sets. Key → key → value = Reference Map of Maps. No key at all = Reference Set.

If your study material consistently marks this as B, it may contain an error - or the question wording in the source material may differ from what you've shared. I'd recommend cross-referencing with the IBM QRadar SIEM documentation on reference data collections to confirm.

No community discussion yet for this question.