C1000-163 · Question #160
Which two types of default building blocks do you need to edit to reduce the number of offenses that are generated by high volume traffic servers?
The correct answer is A. Host Definition E. Network Definition. In IBM QRadar SIEM, Host Definition and Network Definition building blocks are the two default categories you edit to tell QRadar which IP addresses and network ranges belong to high-volume servers (e.g., web, mail, or DNS servers). Once these building blocks are updated…
Question
Which two types of default building blocks do you need to edit to reduce the number of offenses that are generated by high volume traffic servers?
Options
- AHost Definition
- BServer Definition
- CTraffic Definition
- DEvent Definition
- ENetwork Definition
How the community answered
(42 responses)- A71% (30)
- B17% (7)
- C5% (2)
- D7% (3)
Explanation
In IBM QRadar SIEM, Host Definition and Network Definition building blocks are the two default categories you edit to tell QRadar which IP addresses and network ranges belong to high-volume servers (e.g., web, mail, or DNS servers). Once these building blocks are updated, QRadar's detection rules recognize those sources and suppress or tune down the offense generation that would otherwise flood from legitimate high-traffic activity.
Why the distractors are wrong:
- B (Server Definition) and C (Traffic Definition) are not standard QRadar building block types - they don't exist as editable default categories in the rule framework.
- D (Event Definition) relates to how individual log events are parsed and categorized, not to suppressing offense volume from specific hosts or networks.
Memory tip: Think "Hosts live on Networks" - the two things you define to mark high-volume sources are the Host (A) and the Network (E) they belong to. If QRadar knows the host and its network are trusted/high-volume, it stops crying wolf.
Community Discussion
No community discussion yet for this question.