IBM C2150-612 dumps - 100% Pass Guarantee!

What is an example of the use of a flow data that provides more information than an event data?

A. Represents a single event on the network

B. Automatically identifies and better classifies new assets found on a network

C. Performs near real-time comparisons of application data with logs sent from security devices

D. Represents network activity by normalizing IP addresses ports, byte and packet counts, as well as other details

An event is happening regularly and frequently; each event indicates the same target username. There is a rule configured to test for this event which has a rule action to create an offense indexed on the username. What will QRadar do with the triggered rule assuming no offenses exist for the username and no offenses are closed during this time?

A. Each matching event will be tagged with the Rule name, but only one Offense will be created.

B. Each matching event will cause a new Offense to be created and will be tagged with the Rule name.

C. Events will be tagged with the rule name as long as the Rule Response limiter is satisfied. Only one offense will be created.

D. Each matching event will be tagged with the Rule name, and an Offense will be created if the event magnitude is greater than 6.

When QRadar processes an event it extracts normalized properties and custom properties.

Which list includes only Normalized properties?

A. Start time, Source IP, Username, Unix Filename

B. Start time, Username, Unix Filename, RACF Profile

C. Start time, Low Level Category, Source IP, Username

D. Low Level Category, Source IP, Username, RACF Profile

A Security Analyst has noticed that an offense has been marked inactive.

How long had the offense been open since it had last been updated with new events or flows?

A. 1 day + 30 minutes

B. 5 days + 30 minutes

C. 10 days + 30 minutes

D. 30 days + 30 minutes

What is a difference between Rule Actions and Rule Responses?

A. Rule Actions are executed when the Rule is Disabled; Rule Responses require the Rule to be Enabled.

B. Rule Actions are only available for Event and Flow Rules; Rule Responses are available for all Rules.

C. Rule Actions only directly affect the SIEM internals; Rule Responses may send information to external systems.

D. Rule Responses are always processed; Rule Actions may be throttled to ensure they are not executed too frequently.