An administrator would like to categorize discovered assets by port definitions and add this information to a server type building block for further use. Which QRadar Console functionality should…

Question

Options

• AAssets Tab - Actions - Scan
• BAssets Tab - Server Discovery
• CAdmin Tab - Auto Update
• DAdmin - Scheduled Scans

• A
  12% (7)
• B
  79% (45)
• C
  5% (3)
• D
  4% (2)

Explanation

Assets Tab - Server Discovery allows administrators to categorize discovered assets by port definitions and associate that categorization with server type building blocks - exactly what the question describes. Server Discovery scans the network and maps port activity to server roles (e.g., a device responding on port 443 gets tagged as a web server), making that data reusable in building blocks for rules and correlation.

Why the distractors are wrong:

• A (Assets Tab - Actions - Scan): Initiates an active scan of assets but does not handle port-based categorization into server type building blocks.
• C (Admin Tab - Auto Update): Manages content updates (DSMs, protocol definitions, etc.) from IBM - unrelated to asset categorization.
• D (Admin - Scheduled Scans): Configures recurring vulnerability or port scans but does not perform the classification/building block assignment function.

Memory tip: Think "Server Discovery = server type building blocks." The word server appears in both the feature name and the building block type - if the question mentions categorizing assets into server types, Server Discovery is your answer.

No community discussion yet for this question.