C2150-196 Exam Questions

What are the main functions of the Report wizard within IBM Security QRadar SIEM V7.1?

Where is the optimal location for IBM Security QRadar QFIow appliances to monitor Internettraffic?

How is the WinCollect agent enabled to communicate with the IBM Security QRadar SIEM V7.1 (QRadar) console?

In which section can event or flow hashingbe enabled/disabled in IBM Security QRadar SIEM V7 .1?

What action(s) can be taken from the Log and Network Activity tab?

Which user account is used to log in when installing the activation key?

What are three types of rules that can be createdusing the Rule Wizard? (Choose three.)

What is an IBM Security QRadar network object?

Where is a LSX uploaded to IBM Security QRadar SIEM V7.1 to be used by a UDSM in the Admin Section?

When scheduling a vulnerability scan which factor would be controlled by the Concurrency Mask?

How does a rule generate a new Correlation Rule Engine (CRE) event?

Howis a new high level or low level event category added to IBM Security QRadar SIEM V7.1?

By default theServer Discovery function inserts discovered servers into building blocks in which category?

What is the allowable range for Object Weight when defining a network hierarchy object?

What type of host name does IBM Security QRadar SIEM V7.1 require in the network settings Hostname field?

The Retention Properties screen provides many configuration items to allow for managing the contents of the retention bucket. Which two items are available for bucketmanagement? (C...

When adding a managed host using encryption, which network port must be openbi- directionally between the console and new host?

Which script is issued to make changes to the template?

Which two fields are available for indexing in the Index Management page? (Choose two.)

Which two flow sources provide layer 7 payload? (Choose two.)

What is a definingcharacteristic of an asymmetric flow?

When creating a new IBM Security QRadar SIEMV7.1 user account, the administrator did not give access to the log source group (called MS Domain Security Logs) that contains Microsof...

Whichstatement best describes the available options when configuring a new routing rule?

Which statement applies to IBM Security QRadar SIEM V7.1 virtual appliances?

How can asset profiles be searched?

What must be done when creating a user's password on an IBM Security QRadar SIEM V7.1 (QRadar) system that is utilizing Active Directory authentication?

What notation is used to enter a class A network 10.0.0.0 into an IBM Security QRadar SIEM V7.1 network hierarchy?

What must be done first when changing the network settings on a console in a multi- system deployment?

What must be done to put licenses into effect after applying a license file using the Managed License action of the System and License Management dialog?

What is the default password to access the Integrated Management Module remote accesscontroller for an IBM Security QRadar appliance?

Which option is available for sharing offenses with non-IBM Security QRadar users?

How are new reference sets created in IBM Security QRadar (QRadar)?

What must be done prior to clicking on False Positive if flows or events are being viewed in streaming mode?

What is the last step to add aprotocol based log source?

After gathering all required files from the IBM Security QRadar SIEM V7.1 appliance using SSH connectivity which protocol can be used to retrieve the tar.bz2 file or any other file...

On the Offense summary page, which filter is executed when the Events icon or the link with the number of events is clicked?

What is a prerequisite to create a report that contains at least one bar chart?

Offenses can be exported to which two file formats? (Choose two.)

Which two actions allow modification of the current displayed search result set? (Choose two.)

Which function can be used to tune out Events/Flows with a specific QID and a specific destination IP address from contributing to an offense?

After editing the IPTables configuration file, which command reloads the IPTables?

How can ALE be used to collect Windows 2008 events?

What would be considerations for defining a Threshold Rule in the Automated Anomaly Analysis?

Where is the activation key located?

Where in the IBM Security QRadar SIEM V7.1 GUI can information be added abouta network hierarchy?

Which appliance can be used to throttle bandwidth of event collection?

When a routing rule is configured, why might the Drop option be selected?

A network hierarchy consists of these objects: DMZ 192.168.0.0/16 Webservers 192.168.1.0/24 MailServers192.168.2.0/24 UserNetwork 10.0.0.0/8 Which object(s) does 192.168.1.5 fall i...

What is event and flow hashing used for in IBM Security QRadar SIEM V7.1?

Which file should be sent to IBM Support if contacting them for system problems?