A QRadar deployment professional needs to transfer the configuration of a distributed environment (one Console and one EP, not using HA) onto an All-in-One (AIO) system to run some forensics against…

The correct answer is C. The configuration of the source environment should be backed up and then restored on the new. Option C is correct because QRadar's native backup and restore process supports topology changes - a configuration backup taken from a distributed environment (Console + Event Processor) can be successfully restored onto an AIO system, even though the appliance count differs…

Question

A QRadar deployment professional needs to transfer the configuration of a distributed environment (one Console and one EP, not using HA) onto an All-in-One (AIO) system to run some forensics against data that will be added later. What approach should the deployment professional suggest for building the new AIO?

Options

AThe configuration of the source environment should be backed up and then restored on the new
BBecause the destination environment does not have the same number of appliances, the only
CThe configuration of the source environment should be backed up and then restored on the new
DUse rsync to transfer the contents of the /store partition to the new system.

How the community answered

(56 responses)

A
7% (4)
B
16% (9)
C
73% (41)
D
4% (2)

Explanation

Option C is correct because QRadar's native backup and restore process supports topology changes - a configuration backup taken from a distributed environment (Console + Event Processor) can be successfully restored onto an AIO system, even though the appliance count differs. The restore process reconciles the source topology into the destination's single-appliance model, making it the supported and recommended approach for this migration scenario.

Why the distractors are wrong:

Option A is likely worded similarly to C but contains an incorrect condition or unsupported step (such as requiring a full data migration or a specific incompatible method), making it technically inaccurate.
Option B is the classic trap answer - it incorrectly asserts that a topology mismatch (different number of appliances) makes configuration transfer impossible, which is false; QRadar's backup/restore is explicitly designed to handle such changes.
Option D (rsync of /store) would only transfer raw event/log data, not the system configuration. Rsync is not a supported migration tool and would leave the AIO unconfigured.

Memory tip: Think "topology change ≠ blocker" - QRadar backup/restore is topology-agnostic, so whenever a question involves moving between distributed and AIO (or vice versa), the answer is almost always the native backup/restore path, not manual file transfers or workarounds.

Community Discussion

No community discussion yet for this question.

Full C1000-163 Practice