QRadar Flashcards
Where can a user add a note to an offense in the user interface?
A. Dashboard and Offenses tab
B. Offenses tab and Offenses detail window
C. Offenses detail window, dashboard, and Admin tabs
D. Dashboard, Offenses tab, and offenses detail window
B. Offenses tab and Offenses detail window
When might a Security Analyst want to review the payload of an event?
A. When immediately after login, the dashboard notifies the analyst of payloads that must be investigated
B. When “Review Payload” is added to the offense description automatically by the “System: Notification” rule
C. When the event is associated with an active offense, the payload may contain information that is not normalized or extracted fields.
D. When the event is associated with an active offense with magnitude greater than 5, the payload should be reviewed, otherwise it is not necessary
C. When the event is associated with an active offense, the payload may contain information that is not normalized or extracted fields.
Which of the following is property of flows but not events
A. magnitude
B. network
C. bytes
D. log source
C. bytes
Which browser is officially supported for QRadar?
A. Safari version 9.0.3
B. Chromium version 33
C. 32-bit Internet Explorer 9
D. Firefox version 38.0 ESR
D. Firefox version 38.0 ESR
A Security Analyst has noticed that an offense has been marked inactive.
How long had the offense been open since it had last been updated with new events or flows?
A. 1 day + 30 minutes
B. 5 days + 30 minutes
C. 10 days + 30 minutes
D. 30 days + 30 minutes
B. 5 days + 30 minutes
What is a primary benefit of building blocks?
A. They can notify users of strange behavior.
B. They allow the execution of its test within all rules.
C. They generate new events into the pipeline before rules fire.
D. They allow for report results to be used in custom rules tests.
C. They generate new events into the pipeline before rules fire.
What is the difference between Rule Actions and Rule Responses?
A. Rule Actions are executed when the Rule is Disabled; Rule Responses require the Rule to be Enabled.
B. Rule Actions are only available for Event and Flow Rules; Rule Responses are available for all Rules.
C. Rule Actions only directly affect the SIEM internals; Rule Responses may send information to external systems.
D. Rule Responses are always processed; Rule Actions may be throttled to ensure they are not executed too frequently.
C. Rule Actions only directly affect the SIEM internals; Rule Responses may send information to external systems.
What are two benefits of using a netflow flow source? (Choose two.)
A. They can include data payload.
B. They can include router interface information.
C. They can include usernames involved in the flow.
D. They can include ASN numbers of remote addresses.
E. They can include authentication methods used to access the network
B. They can include router interface information.
D. They can include ASN numbers of remote addresses.
Which capability is common to both Rules and Building Blocks?
A. Rules and Building Blocks both set the Magnitude of an Event.
B. Rules and Building Blocks both have the same selection of sets. -
C. Rules and Building Blocks can both be Enabled/Disabled through the GUI.
D. Rules and Building Blocks both have Actions; Building Blocks do not have Responses.
B. Rules and Building Blocks both have the same selection of sets.
Which two actions can be performed on the Offense tab? (Choose two.)
A. Adding notes B. Deleting notes C. Hiding offenses D. Deleting offenses E. Creating offenses
A. Adding notes
C. Hiding offenses
What ability does marking a custom property as “optimized” provide?
A. Allows you to use the custom property in a rule test
B. Allows you to process events above your license rating
C. Allows offenses to merge both events & flows into the same offense
D. Allows for offenses, events & flows to be compared directly in real time
A. Allows you to use the custom property in a rule test
Given the following window:
What are the steps to get this window within an offense?
A. Right click on the IP > Information > DNS Lookup
B. Right click on the IP > Information > Reverse DNS
C. Right click on the IP > Information > WHOIS Lookup
D. Right click on the IP > Information > Asset Profile
A. Right click on the IP > Information > DNS Lookup
A Security Analyst is looking on the Assets Tab at an asset with offenses associated to it.
With a “Right Click” on the IP address, where could the Security Analyst go to obtain all offenses associated with it?
A. Information > Asset Profile
B. Navigate > View by Network
C. Run Vulnerability Scan > Source offenses
D. Navigate > View Source Summary or Destination Summary
B. Navigate > View by Network
Which column shows information as icons on the Reports tab?
A. Owner
B. Formats
C. Schedule
D. Report Name
B. Formats
Events and Flows both have multiple different timestamps available to them.
Which timestamp is available to both events and flows?
A. End Time
B. Storage Time
C. First Activity Time
D. Last Activity Time
B. Storage Time
