C1000-026 · Question #32
An administrator is about to integrate logs from a custom firewall in a QRadar deployment using syslog. The SIEM has two domains, namely Domain A and Domain B. While reviewing the following sample…
The correct answer is B. Create two individual log sources by configuring a separated logging instance for each context on D. Create two individual log sources using the context value as log source identifier and assign each. Options B and D are correct because QRadar enforces a one log source = one domain rule - a single log source cannot be assigned to two different domains simultaneously, making all single-log-source approaches (A, C, E) fundamentally flawed for this requirement. Option B works…
Question
An administrator is about to integrate logs from a custom firewall in a QRadar deployment using syslog. The SIEM has two domains, namely Domain A and Domain B. While reviewing the following sample logs, the administrator notices a "context" keyword:
May 14 11:05:01 192.168.1.23 20190514 11:05:00 context=contextA permit 192.168.1.24 source:
10.10.1.15; source_port: 64094; destination: 10.10.13.34; service: 53; protocol: udp; May 13 12:07:01 192.168.1.23 20190513 11:07:00 context=contextB permit 192.168.1.25 source:
10.10.1.15; source_port: 64094; destination: 10.10.13.34; service: 53; protocol: udp; Which options assign the "contextA" logs to DomainA and the "contextB" logs to domain B? (Choose two.)
Options
- ACreate a single log source, create a "Context" custom event property, and assign the log to both
- BCreate two individual log sources by configuring a separated logging instance for each context on
- CCreate a single log source, create a "Context" custom event property, and assign the log to the
- DCreate two individual log sources using the context value as log source identifier and assign each
- ECreate a single log source, create a "Context" custom event property, and assign the log to the
How the community answered
(22 responses)- A5% (1)
- B82% (18)
- C5% (1)
- E9% (2)
Explanation
Options B and D are correct because QRadar enforces a one log source = one domain rule - a single log source cannot be assigned to two different domains simultaneously, making all single-log-source approaches (A, C, E) fundamentally flawed for this requirement. Option B works by configuring the firewall itself to send contextA and contextB traffic to separate syslog destinations (different ports or IPs), so QRadar sees them as two distinct log sources from the start. Option D works by leveraging QRadar's log source identifier feature, which uses a parsed field value (the context= value) to split an incoming stream into two separate log sources within QRadar - no firewall reconfiguration needed.
Options A, C, and E all fail for the same core reason: creating a custom event property (CEP) for "Context" only extracts the field for reporting or rule use - it has no effect on domain assignment. A CEP cannot dynamically route events to different domains. The subtle differences in wording between A, C, and E are distractors designed to confuse, but none overcome the single-log-source domain limitation.
Memory tip: "Two domains = two log sources, period." If an answer keeps a single log source and relies on a custom property to split domains, it's wrong - custom properties parse data, they don't route it.
Topics
Community Discussion
No community discussion yet for this question.