IBM C2150-612 dumps - 100% Pass Guarantee!

What is an example of the use of a flow data that provides more information than an event data?

A. Represents a single event on the network

B. Automatically identifies and better classifies new assets found on a network

C. Performs near real-time comparisons of application data with logs sent from security devices

D. Represents network activity by normalizing IP addresses ports, byte and packet counts, as well as other details

What set of Key fields can trigger coalescing?

A. Source IP address, Source port, Severity, Username, and Event ID

B. Source IP address, Destination IP address, Destination port, Direction, and Event ID

C. Source IP address, Destination IP address, Destination port, Username, and Event ID

D. Destination IP address, Destination port, Relevance, Username, and Low Level Category

Which log source and protocol combination delivers events to QRadar in real time?

A. Sophos Enterprise console via JDBC

B. McAfee ePolicy Orchestrator via JDBC

C. McAfee ePolicy Orchestrator via SNMP

D. Solaris Basic Security Mode (BSM) via Log File Protocol

What ability does marking a custom property as "optimized" provide?

A. Allows you to use the custom property in a rule test

B. Allows you to process events above your license rating

C. Allows offenses to merge both events and flows into the same offense

D. Allows for offenses, events and flows to be compared directly in real time

Which approach allows a rule to test for Active Directory (AD) group membership?

A. Import the AD membership information into the Asset Database using AXIS and use an asset rule test

B. Use the build-in LDAP integration to execute a search for each event as it is received by the Event Processor to test for group membership

C. Maintain reference data for the AD group(s) of interest containing lists of usernames and then add rule tests to see if the normalized username is in the reference data

D. Export the AD group membership information to a CSV file and place it in the /store/AD_mapping.csv

file on the console, then use the `is a member of AD group' test in the rule