C2150-612 Online Practice Questions and Answers

What is the primary goal of data categorization and normalization in QRadar?

A. It allows data from different kinds of devices to be compared.

B. It preserves original data allowing for forensic investigations.

C. It allows for users to export data and import it into other system.

D. It allows for full-text indexing of data to improve search performance.

What is the default view when a user first logs in to QRadar?

A. Report Tab

B. Offense Tab

C. Dashboard tab

D. Messages menu

What are the various timestamps related to a flow?

A. First Packet Time, Storage Time, Log Source Time

B. First Packet Time, Storage Time, Last Packet Time

C. First Packet Time, Log Source Time, Last Packet Time

D. First Packet Time, Storage Time, Log Source Time, End Time

Given these default options for dashboards on the QRadar Dashboard Tab: Which will display a list of offenses?

A. Network Overview

B. System Monitoring

C. Vulnerability Management

D. Threat and Security Monitoring

Which two are top level options when right clicking on an IP Address within the Offense Summary page? (Choose two.)

A. WHOIS

B. Navigate

C. DNS Lookup

D. Information

E. Asset Summary Page

Which three pages can be accessed from the Navigation menu on the Offenses tab? (Choose three.)

A. Rules

B. By Category

C. My Offenses

D. By Event Name

E. Create Offense

F. Closed Offenses

What set of Key fields can trigger coalescing?

A. Source IP address, Source port, Severity, Username, and Event ID

B. Source IP address, Destination IP address, Destination port, Direction, and Event ID

C. Source IP address, Destination IP address, Destination port, Username, and Event ID

D. Destination IP address, Destination port, Relevance, Username, and Low Level Category

What are two characteristics of a SIEM? (Choose two.)

A. Log Management

B. System Deployment

C. Endpoint Software patching

D. Enterprise User management

E. Event Normalization and Correlation

Which QRadar component stores and forwards events from local and remote log sources?

A. QRadar Data Node

B. QRadar Event Collector

C. QRadar Event Processor

D. QRadar Distributes Console

What is the correct procedure to both assign and add a note to an offense from the Graphical User Interface (GUI)?

A. Both tasks must be done independently and can only be done on the Offenses Tab.

B. With the new release of 7.2.6 this can now be done in one step from the Offenses Tab only.

C. Both tasks must be done independently but can be completed from both the Offenses Tab and the Offense Summary Page.

D. With the new release 7.2.6 this can be done in one step, both the Offenses Tab and the Offense Summary Page.