QRadar Flashcards
Where can a user add a note to an offense in the user interface?
A. Dashboard and Offenses tab
B. Offenses tab and Offenses detail window
C. Offenses detail window, dashboard, and Admin tabs
D. Dashboard, Offenses tab, and offenses detail window
B. Offenses tab and Offenses detail window
When might a Security Analyst want to review the payload of an event?
A. When immediately after login, the dashboard notifies the analyst of payloads that must be investigated
B. When “Review Payload” is added to the offense description automatically by the “System: Notification” rule
C. When the event is associated with an active offense, the payload may contain information that is not normalized or extracted fields.
D. When the event is associated with an active offense with magnitude greater than 5, the payload should be reviewed, otherwise it is not necessary
C. When the event is associated with an active offense, the payload may contain information that is not normalized or extracted fields.
Which of the following is property of flows but not events
A. magnitude
B. network
C. bytes
D. log source
C. bytes
Which browser is officially supported for QRadar?
A. Safari version 9.0.3
B. Chromium version 33
C. 32-bit Internet Explorer 9
D. Firefox version 38.0 ESR
D. Firefox version 38.0 ESR
A Security Analyst has noticed that an offense has been marked inactive.
How long had the offense been open since it had last been updated with new events or flows?
A. 1 day + 30 minutes
B. 5 days + 30 minutes
C. 10 days + 30 minutes
D. 30 days + 30 minutes
B. 5 days + 30 minutes
What is a primary benefit of building blocks?
A. They can notify users of strange behavior.
B. They allow the execution of its test within all rules.
C. They generate new events into the pipeline before rules fire.
D. They allow for report results to be used in custom rules tests.
C. They generate new events into the pipeline before rules fire.
What is the difference between Rule Actions and Rule Responses?
A. Rule Actions are executed when the Rule is Disabled; Rule Responses require the Rule to be Enabled.
B. Rule Actions are only available for Event and Flow Rules; Rule Responses are available for all Rules.
C. Rule Actions only directly affect the SIEM internals; Rule Responses may send information to external systems.
D. Rule Responses are always processed; Rule Actions may be throttled to ensure they are not executed too frequently.
C. Rule Actions only directly affect the SIEM internals; Rule Responses may send information to external systems.
What are two benefits of using a netflow flow source? (Choose two.)
A. They can include data payload.
B. They can include router interface information.
C. They can include usernames involved in the flow.
D. They can include ASN numbers of remote addresses.
E. They can include authentication methods used to access the network
B. They can include router interface information.
D. They can include ASN numbers of remote addresses.
Which capability is common to both Rules and Building Blocks?
A. Rules and Building Blocks both set the Magnitude of an Event.
B. Rules and Building Blocks both have the same selection of sets. -
C. Rules and Building Blocks can both be Enabled/Disabled through the GUI.
D. Rules and Building Blocks both have Actions; Building Blocks do not have Responses.
B. Rules and Building Blocks both have the same selection of sets.
Which two actions can be performed on the Offense tab? (Choose two.)
A. Adding notes B. Deleting notes C. Hiding offenses D. Deleting offenses E. Creating offenses
A. Adding notes
C. Hiding offenses
What ability does marking a custom property as “optimized” provide?
A. Allows you to use the custom property in a rule test
B. Allows you to process events above your license rating
C. Allows offenses to merge both events & flows into the same offense
D. Allows for offenses, events & flows to be compared directly in real time
A. Allows you to use the custom property in a rule test
Given the following window:
What are the steps to get this window within an offense?
A. Right click on the IP > Information > DNS Lookup
B. Right click on the IP > Information > Reverse DNS
C. Right click on the IP > Information > WHOIS Lookup
D. Right click on the IP > Information > Asset Profile
A. Right click on the IP > Information > DNS Lookup
A Security Analyst is looking on the Assets Tab at an asset with offenses associated to it.
With a “Right Click” on the IP address, where could the Security Analyst go to obtain all offenses associated with it?
A. Information > Asset Profile
B. Navigate > View by Network
C. Run Vulnerability Scan > Source offenses
D. Navigate > View Source Summary or Destination Summary
B. Navigate > View by Network
Which column shows information as icons on the Reports tab?
A. Owner
B. Formats
C. Schedule
D. Report Name
B. Formats
Events and Flows both have multiple different timestamps available to them.
Which timestamp is available to both events and flows?
A. End Time
B. Storage Time
C. First Activity Time
D. Last Activity Time
B. Storage Time
Which three could be considered a log source type? (Choose three.)
A. Red Hat Network B. IBM ISS Proventia C. QRadar Event Processor D. Check Point Firewall-1 E. Sourcefire Flow Injector F. McAfee ePolicy Orchestrator
B. IBM ISS Proventia
D. Check Point Firewall-1
F. McAfee ePolicy Orchestrator
What are two common uses for a SIEM? (Choose two.)
A. Managing and normalizing log source data
B. Identifying viruses based on payload MD5s
C. Blocking network traffic based on rules matched
D. Enforcing governmental compliance auditing and remediation
E. Performing near real-time analysis and observation of a network and its devices
A. Managing and normalizing log source data
B. Identifying viruses based on payload MD5s
Which of the following is property of flows but not events
A. magnitude
B. network
C. bytes
D. log source
C. bytes
At what speed do events appear on the status bar.
Average per second
What is maximum time interval of which QRadar coalesces identical events
10 seconds
How many timestamps does an event have,
3 timestamps (Start time, Storage Time, Log Source Time)
As a security analyst you noticed that the event processor stores unparsed events in the data nodes. Why is this happening?
parsing errorthe system is under high load
You select to follow up an offense from the offense list. What happens to this offense?
A. All analysts receive mail
B. ONly you can close this offense
C. A flag appears next to the offense
D. This offense is now flagged for further investigation
C. A flag appears next to the offense
D. This offense is now flagged for further investigation
From where do you send mail.
Offense tab, Action > Mail
What does it mean when an event is classified as Unknown (unparsed, sim audi, sim generic)
Event was parsed but not mapped
When new offenses arrives, what is the first action the security team must do
View the attack port of the offense
Where are offenses collected A. console B. node C. processor D. collector
A. console
Check point
OPSEC LEA/Syslog
New log source was created and low level category is stored
Events are not correctly parsed
Admin tab > log sources > parsing order
