IBM
C1000-163 · Question #15
Which two options does a QRadar analyst need to configure in the False Positive window of the QRadar Console to mark an event or flow as False Positive?
The correct answer is C. Event or flow property and traffic direction. See the full explanation below for the reasoning.
Question
Which two options does a QRadar analyst need to configure in the False Positive window of the QRadar Console to mark an event or flow as False Positive?
Options
- AEvent or flow property and username
- BAsset and traffic direction
- CEvent or flow property and traffic direction
- DEvent or flow property and port number
How the community answered
(46 responses)- A7% (3)
- B2% (1)
- C78% (36)
- D13% (6)
Community Discussion
No community discussion yet for this question.