After fixing the assets that contributed to the asset growth deviation, an administrator needs to find the asset artifacts that have to be cleaned up. What action should the administrator take to…

Question

Options

• AOn the "Log Activity" tab, run the "Deviating Asset Growth: Asset Report event search"
• BOn the Admin Tab, select System Configuration --> Asset Profiler Configuration
• CRun the ./cleanAssets.sh --list command
• DOn the Asset tab, run the "Clean Assets" action

• A
  77% (47)
• B
  11% (7)
• C
  8% (5)
• D
  3% (2)

Explanation

Option A is correct because the Log Activity tab is where event searches are run in QRadar, and the "Deviating Asset Growth: Asset Report" event search is specifically designed to surface the asset artifacts associated with the growth deviation - giving the administrator a list of what needs cleanup before taking any action.

Option B is wrong because Asset Profiler Configuration (Admin tab) is used to configure how assets are profiled, not to identify artifacts requiring cleanup. Option C is a distractor - no such cleanAssets.sh --list shell script exists in the QRadar workflow for this purpose. Option D is tempting but backwards: the "Clean Assets" action on the Asset tab performs the cleanup; it doesn't help you find what needs to be cleaned first.

Memory tip: Think "find before you fix" - the Log Activity tab is your investigative space (searches and reports), while the Asset tab is your action space. You always investigate on Log Activity first, then act on the Asset tab.

No community discussion yet for this question.