What approach does QRadar take when it imposes EPS license (not hardware) limits on events that temporarily spike above that limit?

Question

Options

• AExcessive events in a spike cause a System Notification that advises the customer to increase
• BQRadar EPS license allocation is implemented with a hard cutoff to ensure resources are not
• CDuring the spike, excess events are written to a queue, and they are processed after the EPS rate
• DQRadar EPS licensing is measured as an average over a 24-hour period, which allows spikes to

• A
  4% (1)
• B
  13% (3)
• C
  74% (17)
• D
  9% (2)

Explanation

Option C is correct because QRadar uses a queuing mechanism for EPS license enforcement - when events temporarily spike above the licensed limit, the excess events are not dropped or ignored but instead buffered in a queue and processed once the ingest rate falls back within the licensed threshold. This ensures no events are lost during short-lived bursts while still respecting the license boundary over time.

Why the distractors are wrong:

• A is wrong because QRadar does more than alert - it actively handles the excess events by queuing them rather than just notifying the administrator.
• B is wrong because there is no hard cutoff that drops or rejects events; the queue-based approach is specifically designed to avoid data loss.
• D is wrong because QRadar EPS licensing is not measured as a rolling 24-hour average - that would be a different (and more permissive) model than what QRadar actually implements.

Memory tip: Think of it as a checkout queue at a busy store - when the line (event rate) gets too long, customers (events) aren't turned away (no hard cutoff) and the manager isn't just paged (no mere notification) - they wait in line and get served when capacity frees up. Queue = no data loss.

No community discussion yet for this question.