C2150-196 Exam Questions

What is required to configure users for successful external authentication?

When creating a behavioral rule in Automated Anomaly Analysis, which three components are weighted todetermine the rule?

Which statement best describes the advantages of implementing NetFlow monitoring?

How are user permissions applied using Log Source groups?

This command provides what informationwhen run from an IBM Security QRadar QFlow 1202 appliance: grep `Sent.\ + flows' /var/log/qradar.log?

Which IBM Security QRadar SIEM V7.1 appliance types are designed to collect, process, and store log event messages?

How does the order of rule tests affect the ORE performance?

What step must be completed before searching restored data on a newly installed console?

Given that ICMP pings from all hosts are dropped, which rule(s) allows ICMP pings and responses only from and to host 10.35.100.23?

What must be provided when utilizing kickstart disks to install IBM Security QRadar SIEM V7.1 software on customersupplied hardware?

Where is WinCollect configured as an Authorized Service?

Which search option is mandatory before producing a time series graph?

The ip_context_menu.xml file was edited in order to access additional details for selected IP addresses. Which service must be restarted for the changes to take effect?

What is the default download path directory where DSM, minor, and major updates are stored before being deployed?

Which IBM Security QRadar SIEM V7.1 DSM protocol supports the collection of Microsoft SMTPI OWA, and message tracking logs?

How are values mapped in a LSXto parse data from a payload for a UDSM?

After clicking on the Backup and Recovery button in the Admin tab, which three options are found in the Backup Archives page? (Choose three.)

What must be done in order to use the data present on the Log Activity screen for a report?

Which two items must be provided prior to the initial installation and configuration of IBM Security QRadar SIEM V7.1 appliance? (Choose two.)

What must be done to enable High Availability (HA) disk synchronization?

Which Admin function enables system performance alerts?

How is a High Availability (HA) cluster installed from the Admin tab?

Prom the Dashboard view, the Compliance Overview dashboard >Login Failures by User (real- time) workspace is being reviewed. Which link provides more details about these events?

What happens topreviously collected events when an event is mapped?

What are two ways an asset can be added to asset profiles? (Choose two.)

Why is coalescing important to a non-admin user?

What is an Offense Type?

Which statement is most accurate regarding the information that NetFlow provides?

Which SNMP protocol should be used when confidentiality, integrity, and authentication are required?

What two types of retention buckets are available in IBM Security QRadarSEM V7.1? (Choose two.)

The last two digits of an appliances type can be used to determine which capability?

A customer has indicated that Windows events must be collected without the use of agents. Which protocol should be selected in theProtocol Configuration when adding a Microsoft Win...

In the Offense Summary page, which field indicates if an attack was sudden or if the attack occurred over a long period of time?

Which four fields are used when importing assets from a CSV file?

A flow is always based on what?