C1000-156 exam

When will events or flows stop contributing to an offense?A . When the offense becomes dormantB . When the offense becomes inactiveC . After the offense is assigned to an analystD . When you protect the offenseView AnswerAnswer: A Explanation: In IBM QRadar SIEM V7.5, events or flows stop contributing...

When configuring a log source, which protocols are used when receiving data into the event ingress component?A . SFTR HTTP Receiver, SNMPB . Syslog, HTTP Receiver, SNMPC . Syslog, FTP Receiver, SNMPD . Syslog, HTTP Receiver, JDBCView AnswerAnswer: B Explanation: When configuring a log source in IBM QRadar SIEM V7.5,...

Which authentication type in QRadar encrypts the username and password and forwards the username and password to the external server for authentication?A . RADIUS authenticationB . Two-factor authenticationC . TACACS authenticationD . System authenticationView AnswerAnswer: C Explanation: TACACS (Terminal Access Controller Access-Control System) authentication is a protocol used in IBM...

Which two (2) pieces of information from the MaxMind account must be included in QRadar for geographic data updates?A . Account/User IDB . API keyC . License KeyD . MaxMind usernameE . API passwordView AnswerAnswer: B, C Explanation: To include geographic data updates from MaxMind in IBM QRadar SIEM V7.5,...

To detect outliers, which Anomaly Detection Engine rule tests events or flows for volume changes that occur in regular patterns?A . Behavioral rulesB . Threshold rulesC . Anomaly rulesD . Building block rulesView AnswerAnswer: C Explanation: In IBM QRadar SIEM V7.5, Anomaly Detection Engine rules that test events or flows...

In which QRadar section can the administrator view the license giveback rate?A . Admin tab > system settingsB . Log Activity tab > AQL query in the Advanced Search "select LicenseGiveback from license"C . Admin tab > License pool managementD . Log Activity tab by searching for the term "giveback"...

What is the main reason for tuning a building block?A . Increasing the performance of the ecs-ec-ingress serviceB . Reducing the number of false positivesC . Properly documenting the building block for future administratorsD . Reducing EPS usageView AnswerAnswer: B Explanation: Tuning a building block in IBM QRadar SIEM V7.5...

Which command does an administrator run in QRadar to get a list of installed applications and their App-ID values output to the screen?A . opt/qradar/support/deployment_info.shB . /opt/qradar/support/recon psC . /opt/qradar/support/recon connect 1005D . /opt/qradar/support/threadTop.shView AnswerAnswer: A Explanation: To get a list of installed applications and their App-ID values in IBM...

Which is a benefit of a lazy search?A . Getting results that are limited to a specific rangeB . Providing every result no matter the quantity of the search resultsC . Finding lOCs quicklyD . Searching across domains for any configured userView AnswerAnswer: A Explanation: A lazy search in IBM...

Which User Management option manages the QRadar functions that the user can access?A . Security ProfileB . Admin RoleC . Security OptionsD . User RoleView AnswerAnswer: A Explanation: In IBM QRadar SIEM V7.5, managing what functions a user can access is crucial for maintaining security and ensuring that users have...