IBM C2150-614 問題集

質問 1：
A Deployment Professional is alerted that flows between two assets within a local network are
communicating at a higher rate than normal between midnight and 2 a.m. The Deployment Professional is
asked to determine why this is occurring and decides to create an alert that will send a notification when
the communication happens again.
Which action could be used?
A. Create rule to test for events/flows
B. Run an AQL query
C. Perform Custom search
D. Perform Quick search
正解：A
解説: (Topexam メンバーにのみ表示されます)

質問 2：
What is the procedure to configure basic system settings on an IBM Security QRadar V7.2.7 system once
the System Configuration panel is accessed under the Admin Tab?
A. 1. System Settings > (Configure Settings) > Save 2. Admin Tab > Advanced > Deploy Full
Configuration
B. 1. Configure Settings > Save 2. Admin Tab > Advanced > Deploy Full Configuration
C. 1. Configure Settings > Save 2. Admin Tab > Advanced > Deploy Changes
D. 1. System Settings > (Configure Settings) > Save 2. Admin Tab > Advanced > Deploy Changes
正解：A
解説: (Topexam メンバーにのみ表示されます)

質問 3：
A Deployment Professional needs to handle event logs from Point-of-Sale (POS) devices on cruise ships
which have sporadic connectivity to the rest of the deployment.
Which appliance can be used to store and forward these events?
A. QRadar Event Processor 1628
B. QRadar Flow Collector 1201
C. QRadar Flow Processor 1705
D. QRadar Event Collector 1501
正解：D
解説: (Topexam メンバーにのみ表示されます)

質問 4：
A Deployment Professional is asked to schedule the forwarding of events when the network is quiet,
usually around 2 to 3 a.m. console time. The customer states that there is no restriction to bandwidth on
the available 1 Gbp/s WAM connection during this time.
Which value should be used for the forward transfer rate?
A. 0
B. 10,000,000
C. 1,000,000
D. 1
正解：A
解説: (Topexam メンバーにのみ表示されます)

質問 5：
A client has reached the maximum of 5000 EPS for their 3128 All-in-One appliance. They have just
completed an acquisition of a competitor company and would like to get them on-board with collecting
events for correlation in QRadar. It has been determined that the newly acquired company has a large
number of log sources, and it is estimated that its total EPS will be approx. 22000 EPS.
What will meet the hardware requirements when changing to a distributed environment?
A. 1624 Event Processor
B. 1605 Event Processor
C. 1628 Event Processor
D. 1622 Event Processor
正解：C
解説: (Topexam メンバーにのみ表示されます)

質問 6：
A Deployment Professional is investigating why a rule has stopped triggering. The rule is configured to
monitor certain events from a specific syslog based Log Source. Upon investigation, the Deployment
Professional observes that no events are being received by that Log Source in the Log Activity Tab.
The customer has recently reconfigured the sending system but demonstrates that events are still being
sent to the QRadar Event Processor. After running a tcpdump on the Event Processor, events are indeed
observed coming from the IP address of the sending system.
How can the Deployment Professional find an event in the QRadar GUI to discover which Log Source the
events are being processed?
A. Log Activity Tab -> Add Filter -> "Parameter Field" select "PayLoad Contains" and enter a unique
identifier based off the tcpdump data
B. Network Activity Tab -> Advanced Search -> "Parameter Field" select "Hostname" and enter a
hostname
C. Network Activity Tab -> Add Filter -> "Parameter Field" select "Payload Contains" and enter a unique
identifier based off the tcpdump data
D. Log Activity Tab -> Add Filter -> "Parameter Field" enter "Hostname" and enter a hostname
正解：D
解説: (Topexam メンバーにのみ表示されます)