Brainscape's Knowledge GenomeTM

Browse over 1 million classes created by top students, professors, publishers, and experts.


See full index

Cyber Security#1 > QRadar#2 > Flashcards

QRadar#2 Flashcards

1
Q

Difference between Local and global rules

5 login failures by the same user in 10 minutes

A

local - all 5 login failures must appears on the same event processor
global - if 3 login fails were on an EP and 2 on second

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
2
Q 
A QRadar user needs to enable/disable few of the rules. Which role permission is required for
enabling and disabling the rule?
A. Offenses > Maintain CRE Rules
B. Offenses > Maintain Use Cases
C. Offenses > Toggle Custom Rules
D. Offenses > Maintain Custom Rules
A

D. Offenses > Maintain Custom Rules

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
3
Q

Which mode provides an analyst with a real-time view of their current event activity by
displaying a continuously updating sample of the most recent events?
A. Live Events
B. Real Time (displaying)
C. Real Time (streaming)
D. Last Interval (auto refresh)

A

C. Real Time (streaming)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
4
Q

How does an analyst determine which rules are most active in generating Offenses?
A. Assets -> Rules -> click Offense Count to reorder the column in ascending order
B. Admin -> Rules -> click Offense Count to reorder the column in descending order
C. Offenses -> Rules -> click Offense Count to reorder the column in ascending order
D. Offenses -> Rules -> click Offense Count to reorder the column in descending order

A

D. Offenses -> Rules -> click Offense Count to reorder the column in descending order

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
5
Q 
What is the maximum length of the Notes field in the Offenses tab?
A. 1000
B. 1200
C. 1500
D. 2000
A

D. 2000

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
6
Q 
How many active Offenses can be in the QRadar system? 
A. 2500
B. 3000
C. 3500
D. 4000
A

A. 2500

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
7
Q

The analyst needs to export an Offense outside QRadar to make a report of the incident.
Which export format is supported? (Choose two)
A. TSV (Tab Separated Values)
B. CSV (Comma Separated Values)
C. Fixed Field Text (Plain Text)
D. XML (Extensible Markup Language)
E. HTML (Hypertext Markup Language)

A

B. CSV (Comma Separated Values)

D. XML (Extensible Markup Language)

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
8
Q 
What period of inactivity causes an offense to go into dormant state?
A. 5 days
B. 5 hours
C. 30 days
D. 30 minutes
A

D. 30 minutes

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
9
Q

A high number of Offenses are being generated for a specific event type.
What can the analyst do to investigate why Offenses are being created?
A. Review the health notification Offense rules.
B. Review the rules used in creating the Offense.
C. Review the Offense and enable the Offense high event rules.
D. Review the log sources and enable the anomaly Offense detection rules

A

B. Review the rules used in creating the Offense.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
10
Q 
Which time stamp is used to determine whether events are being queued in the event pipeline
for performance or licensing reasons?
A. Start Time
B. Device Time
C. Storage Time
D. Log Source Time
A

C. Storage Time

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
11
Q

When is the offense magnitude re-evaluated

A

when new events are added to the offense.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
12
Q

What are the chart types in the dashboard.

A

Pie, Table, Bar, Time Series

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
13
Q

What are the chart types in the report

A

Bar, Pie, Table, Line, Stacked Line, Stacked Bar

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
14
Q 
Super flow types:
Type A - network sweep
Type B - DDoS
Type C - port scan
Standard
A

Type B - DDos

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
15
Q

Where is the vulnerability information located?

A

Asset tab

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
16
Q

Base 64

A

Payload -> base 64

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
17
Q 
Schedule report is every Monday and the first day of mount. When they want a report on Thursday.
MON - WED
MON - THU (THU - WED)
whole last week 
from last week to THU
A

whole last week

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
18
Q

DSSE (device stop sending events)

A

runs in the absence of events.

How well did you know this?
1
Not at all
2
3
4
5
Perfectly
19
Q

Search for all viruses

A

Pause event/flow, double-click it, press Extract Property to extract virus (e.g. MD5),
Creating custom rule that use extracted property as an offense index field. Search by offense type.

20
Q

Analyst. Manually generation report

A

Does not restart the existing report schedule.

21
Q

Where are the Notes and Annotations located?

A

Bottom offense summary page

22
Q

For 10min 15 mails received and see only 1 offense

A

Coalescing

23
Q

What columns are defaultly displayed in offense log?

A

QID

Log source

24
Q

New log source was created and low level category is stored

A

Events are not correctly parsed

Admin tab > log sources > parsing order

25
Q

Where are offenses collected

  • console
  • node
  • processor
  • collector
A

console

26
Q

Where is the VPN log source

A

Advanced persistent threat, securing the cloud, insider threat, critical data protection.

27
Q

AQL - 2

A

/.pdf/or/.exe/

28
Q

How does a Device Support Module (DSM) function?
A DSM is a configuration file that combines received events from multiple log sources and displays them as offenses in QRadar.
A DSM is a background service running on the QRadar appliance that reaches out to devices deployed in a network for configuration data.
A DSM is a configuration file that parses received events from multiple log sources and converts them to a standard taxonomy format that can be displayed as outputs
A DSM is an installed appliance that parses received events from multiple log sources and converts them to a standard taxonomy format that can be displayed as outputs.

A

A DSM is a configuration file that parses received events from multiple log sources and converts them to a standard taxonomy format that can be displayed as outputs

29
Q

Share the offense summary information with another person by sending an email.
The body of the email message includes the following information, if available:

A

Total number of sources
Top five sources by magnitude
Total number of destinations
Top five categories

30
Q

See if Auth. are valid

A

Filter Username group by source IP, then validate the source IP

31
Q

How offense was created

A

Event: QID, payload, category, management

32
Q

How offense was created

A

Event: QID, payload, category, management

33
Q

Creating a new custom property

A

Event Based

34
Q

Events routed directly to storage by CRE

A

High loss

35
Q

Filter in LA tab to get list of log sources not reporting to QRadar

A

Log sources status =/ active

36
Q

Quick search saved

A

advanced query

37
Q

Offense naming mechanism

A

set of associated

38
Q

Default log activity page

A

Protocol, log S, QID, E name, Qmap

39
Q

Checkpoint

A

CP ResetAPI, syslog, OPsecilea, jobc, sftp.

40
Q

Repeated offenders and IPs that have many attacks

A

Ev. Cat. or Ev. Source, Source IP or D. IP, E or F, Log S. IP or Ev. source

41
Q

Assets tab

A

triggered off, events and flows, network devices and log sources

42
Q

Where in rules details can you find why the rules were triggered?

A

Rule: responses, actions, response limiters, list of test conditions.

43
Q

regex tests

A

position of rule tests that evaluate regular expressions

44
Q

regex test answers

A

the most expensive, stateful-last, building blocks, the most specific

45
Q

geo location

A

GPS and Map, longitude and latitude, log activity, and network activity, group and IP.

Cyber Security#1 (7 decks)

Brainscape helps you reach your goals faster, through stronger study habits.
© 2024 Bold Learning Solutions. Terms and Conditions