An administrator has to change the system hardware clock of the QRadar server. The administrator has already restarted the main services (hostservices, tomcat, hostcontext) and needs to synchronize…

Question

Options

• A/opt/qradar/support/all_servers.sh systemctl restart systemd-timedated.service
• B/opt/qradar/support/all_servers.sh /opt/qradar/bin/time_sync.sh
• C/sbin/hwclock -systohc /opt/qradar/bin/time_sync.sh
• D/opt/qradar/support/all_servers.sh service ntpd restart

• A
  7% (3)
• B
  75% (33)
• C
  5% (2)
• D
  14% (6)

Explanation

Option B is correct because QRadar provides two purpose-built tools that work together here: all_servers.sh propagates a command across the Console and all managed hosts, while time_sync.sh is QRadar's dedicated script for pushing time synchronization out to the deployment - exactly what's needed after a hardware clock change.

Why the distractors fail:

• A restarts the systemd-timedated service on all servers, but restarting a time daemon service doesn't force the managed hosts to adopt the Console's updated time.
• C is syntactically invalid - hwclock -systohc syncs the hardware clock to the system clock locally, and it doesn't accept a script path as an argument; this command would error out and does nothing for managed hosts.
• D restarting ntpd on all hosts would cause them to re-poll their NTP sources, but that source may not be the QRadar Console itself, so managed hosts could drift rather than align to the corrected time.

Memory tip: Think of it as two layers - all_servers.sh = reach everywhere, time_sync.sh = do the time sync. Whenever QRadar needs a fleet-wide operation, all_servers.sh is the wrapper; whenever time needs to propagate after a clock change, time_sync.sh is the payload.

No community discussion yet for this question.