An administrator wants to have all QRadar apps running on a new App Host that was configured to have dedicated CPU, storage and memory resources for the Apps. Several issues were presented during…

Question

Options

• AIf the completion of the /opt/qradar/check_app_host.sh script was successful
• BIf port 5000 is opened on the console
• CIf an IP table entry was already created to allow traffic from the App Host IP
• DIf IP tables are disabled on the console

• A
  7% (2)
• B
  74% (20)
• C
  4% (1)
• D
  15% (4)

Explanation

Port 5000 is the dedicated communication port that QRadar's App Framework uses between the Console and the App Host appliance. If this port is blocked or closed on the Console's firewall, the App Host cannot register, authenticate, or exchange app management traffic with the Console - causing installation failures regardless of how the App Host itself is configured.

Why the distractors are wrong:

• A - /opt/qradar/check_app_host.sh is not a real QRadar diagnostic script for App Host validation; IBM's official troubleshooting path focuses on network connectivity, not this file.
• C - Checking for a specific IP table entry for the App Host IP is too narrow; the real bottleneck is whether the required port is reachable, not just whether a host-level rule exists.
• D - Fully disabling IP tables on the Console would be a security risk and is never a recommended troubleshooting step; the correct action is to open the specific required port, not remove the firewall entirely.

Memory tip: Think of port 5000 as the "front door" of the QRadar Console for App Host traffic - if the door is locked (port closed), no apps can move in no matter how well the App Host is set up. When App Host installation fails, always knock on port 5000 first.

No community discussion yet for this question.