IBM C1000-026 Exam Training Material

dumps2022-01-24T02:47:22+08:00

IBM Certification C1000-026 exam training material will be helpful for you to take the test. In real IBM C1000-026 exam, there are 60 questions, and you have 90 minutes to finish the test. The number of questions required to pass is 40. The test languages are English and Japanese. The exam price is $200. Free IBM C1000-026 exam training material is available below.

Page 1 of 2

1. An administrator needs to import data into QRadar for a specific use case. The data that has been provided to the administrator is stored in records that map a key to a value.

Which type of data collection must the administrator create?

Reference set

Reference map of sets

Reference map

Reference map of maps

2. An administrator needs to know if a custom rule is being correlated correctly.

Which QRadar component is responsible for this process?

QRadar Event Collector

QRadar Console

Magistrate

QRadar Event Processor

3. An administrator needs to collect logs from the Command Line Interface (CLI).

Which command should the administrator use?

/opt/bin/qradar/support/get_logs.sh

/opt/support/get_logs.sh

/opt/support/qradar/get_logs.sh

/opt/qradar/support/get_logs.sh

4. To comply with specific regulations, an administrator has been requested to increase asset retention to 365 days.

In which QRadar section can the administrator find the asset retention settings?

Admin Tab / Asset Retention

Assets Tab / Retention settings

Admin Tab / System settings

Assets Tab / Asset Retention

5. A QRadar administrator added High Availability (HA) to the Event Processor and needs to verify the crossover link status between the primary and secondary hosts.

Which commands can be used to verify the crossover status? (Choose two.)

/opt/qradar/ha/bin/ha_getstate.sh

/opt/qradar/ha/bin/getStatus crossover

/opt/qradar/ha/bin/qradar_nettune.pl crossover status

/opt/qradar/ha/bin/qradar_nettune.pl linkaggr <interface> status

/opt/qradar/ha/bin/ha cstate

cat /proc/drbd

6. Which event routing rule is required to add QRadar Data Store (QDS) capability to a deployment?

Log Only (exclude Analytics)

Delete data When storage space is required

Bypass Correlation

Delete data immediately after the retention period has expired

7. An administrator is seeing the following system notification:

38750057 C A protocol source configuration may be stopping events from being collected.

What is a valid user action to this issue?

Re-install the QRadar Console

Review the /var/log/qradar.log file for more information

Restart the QRadar Console

Review the /var/log/error.log file for more information

8. An administrator needs to import a list of HR staff logins into a reference set.

Which file type can be used with the import function in the reference set editor window?

xml

csv

xls

json

9. An administrator is about to integrate logs from a custom firewall in a QRadar deployment using syslog. The SIEM has two domains, namely Domain A and Domain B.

While reviewing the following sample logs, the administrator notices a “context” keyword:

May 14 11:05:01 192.168.1.23 20190514 11:05:00 context=contextA permit 192.168.1.24 source: 10.10.1.15; source_port: 64094; destination: 10.10.13.34; service: 53; protocol: udp;

May 13 12:07:01 192.168.1.23 20190513 11:07:00 context=contextB permit 192.168.1.25 source: 10.10.1.15; source_port: 64094; destination: 10.10.13.34; service: 53; protocol: udp;

Which options assign the “contextA” logs to DomainA and the “contextB” logs to domain B? (Choose two.)

Create a single log source, create a “Context” custom event property, and assign the log to both domains using a custom rule.

Create two individual log sources by configuring a separated logging instance for each context on the firewall and assign each log source to the correct domain.

Create a single log source, create a “Context” custom event property, and assign the log to the correct domain using custom event property value.

Create two individual log sources using the context value as log source identifier and assign each log source to the correct domain.

Create a single log source, create a “Context” custom event property, and assign the log to the correct domain using a custom rule.

10. An administrator plans to deploy multiple log sources that share a common configuration.

How many log sources can be added at one time?

1000

750

250

500

Page 2 of 2

11. 168.67.0/24

What is the correct supernet for these subnets?

Network 192.168.66.0 with subnet mask 255.255.252.0

Network 192.168.64.0 with subnet mask 255.255.252.0

Network 192.168.64.0 with subnet mask 255.255.255.0

Network 192.168.66.0 with subnet mask 255.255.252.0

12. Due to regulatory constraints, an administrator must increase the minimum password length and complexity.

In which QRadar section can the administrator change this setting?

Admin / System settings

Admin / Password policy

Admin / Security profiles

Admin / Authentication

13. Which log should be reviewed to determine the reasons a patch installer did not proceed during a QRadar upgrade?

/var/log/qradar.audit

/var/log/qradar.log

/var/log/setup-*/patches.log

/var/log/upgrade.log

14. An administrator has added a new Event Processor to a QRadar deployment.

How many events per second (EPS) are granted from the temporary license and how many days will those EPS last?

10000 EPS for a 35 day period

5000 EPS for a 45 day period

10000 EPS for a 45 day period

5000 EPS for a 35 day period

15. How many default dashboards does QRadar have?

IBM C1000-026 Exam Training Material

IBM C1000-026 Exam Training Material

Share this post

Leave a Reply Cancel reply

Related Posts