[Feb 01, 2022] C1000-055 Exam Dumps - IBM Practice Test Questions
New Real C1000-055 Exam Dumps Questions
NEW QUESTION 10
A deployment professional has been asked to ensure the system can be integrated with another system which contains lists of IP addresses and CIDR ranges in an automated manner, to allow rules to target specific communication endpoints.
Which part of QRadar is designed to hold and manage this data?
- A. Building Blocks
- B. Domain Definition
- C. Asset Profiles
- D. Network Hierarchy
Answer: A
NEW QUESTION 11
A deployment professional needs to add a new log source using the Log File protocol. The log source should be limited to 2000 EPS.
Which option of a log source should be configured?
- A. FPM Throttle
- B. EPS Throttle
- C. Maximum EPS
- D. Maximum FPM
Answer: C
NEW QUESTION 12
A deployment professional needs to create a SIEM architecture plan. The deployment professional needs to consider applying a set of security policies (or questions) about the client's network and monitor the policies for changes. It is important also to query all network connections, compare device configurations, filter the network topology, and simulate the possible effects of updating device configurations.
Which component can be added to the deployment to meet this security business objective?
- A. QRadar Incident Forensics
- B. QRadar Network Insights
- C. QRadar Vulnerability Manager
- D. QRadar Risk Manager
Answer: C
NEW QUESTION 13
A deployment professional configures QRadar auto-update with the automatic install option for all update types where automatic install is available.
Assuming all auto-update installations are successful, which update types will need manual installation?
- A. Application updates, DSM, scanner and protocol updates
- B. Major updates, scanner and protocol updates
- C. Application updates and major updates
- D. Configuration updates and WinCollect updates
Answer: A
NEW QUESTION 14
A deployment professional sees the following notification in the IBM QRadar Notification Section. "The Accumulator has fallen behind." To which performance issues does the notice refer to?
- A. External Storage
- B. Event Pipeline
- C. Flow Pipeline
- D. Global Views
Answer: A
NEW QUESTION 15
A deployment professional needs to check which rules cause events to be dropped on the Console with Pipeline NATIVE_To_MPC messages.
Which script would help with this task?
- A. /opt/qradar/support/findExpensiveCustomProperties.sh
- B. /opt/qradar/support/astat.sh
- C. /opt/qradar/support/findRules.sh
- D. /opt/qradar/support/findExpensiveCustomRules.sh
Answer: B
NEW QUESTION 16
A deployment professional needs to configure network devices to send IPFIX to a QRadar deployment consisting of 1 QRadar Console 3129 and 2 QRadar Event Processors 1629. The routers will send more than 1
000 000 FPM.
Which component should be added to the existing deployment?
- A. Flow Processor
- B. AppHost
- C. Event Collector
- D. DataNode
Answer: C
NEW QUESTION 17
The iSCSI offboard storage is being configured. Which sequence should be used?
- A. Stop services on QRadar > Mount iSCSI file system > Migrate the data to iSCSI > Configure iSCSI
- B. Stop services on QRadar > Configure iSCSI > Mount iSCSI file system /store > Migrate the data to iSCSI
- C. Configure iSCSI > Stop services on QRadar > Migrate the data to iSCSI > Mount iSCSI file system
- D. Stop services on QRadar > Migrate the data to iSCSI > Configure iSCSI > Mount iSCSI file system
Answer: C
NEW QUESTION 18
A deployment professional needs to clear out the Asset Database in IBM QRadar. Which service on the Console is restarted when script cleanAssetModel.sh is executed?
- A. Tomcat
- B. PostgressDB
- C. Hostservices
- D. Hostcontext
Answer: C
NEW QUESTION 19
A deployment professional has been asked to create some Reference Data to identify activity on executive's email addresses. The customer has provided the list of the current email addresses and has stated that these need to be updated from time to time as the organization changes. Changes should be handled in the standard Graphical User Interface (GUI) of the QRadar Console.
Which Reference Data should the deployment professional create for this purpose?
- A. Reference Table
- B. Reference Map
- C. Reference Map Of Sets
- D. Reference Set
Answer: D
NEW QUESTION 20
A company that is located in the United States wants to expand its existing QRadar deployment to data centers located in Europe. The European branch needs to keep its data in-country and must comply with local data retention regulations.
What can the deployment professional do to comply with local data laws?
- A. Install Event and Flow Processors in the United States data center.
- B. Install Event and Flow Collectors in the European data center.
- C. Install Event and Flow Processors in the European data center.
- D. Install Data Nodes in the European data center.
Answer: B
NEW QUESTION 21
A deployment professional is about to execute Server Discovery to populate the Host Definition Building Blocks. The deployment professional is working in a monitored environment and does not wish to set off any network scanner alarms.
What step should the deployment professional take to ensure that good results are returned and that no alarms are raised?
- A. Warn the network monitoring team that QRadar is about to run a network port scan
- B. Ensure that events from the relevant servers are being collected successfully
- C. Set the 'Passive discovery' flag in Advanced System Settings in the Admin tab
- D. Ensure that the flow sources are configured correctly and collecting data
Answer: C
NEW QUESTION 22
A deployment professional is working on integrating an unsupported log source. The log source is able to send events in multiple formats. The administrators of the log source ask which event format should be configured.
Which event format should the deployment professional choose to be able to use direct parsing support in QRadar's DSM editor?
- A. Regex
- B. LEEF
- C. SAML
- D. BLOB
Answer: D
NEW QUESTION 23
QRadar is configured to periodically update an IP address list from a 3rd party threat intelligence provider using the Threat Intelligence app. The IP address data is used in a CRE rule to create an offense in case a connection attempt toward any IP address on the list is seen.
Which QRadar component stores the collected IP address data?
- A. Custom Rule
- B. Reference Set
- C. X-Force Threat Feed
- D. Building Block
Answer: C
NEW QUESTION 24
A deployment professional receives instructions to virtualize the currently installed QRadar SIEM All-in-One appliance and to provide requirements. VM specifications must suffice for 4000 EPS.
What are the minimum processor and memory requirements that the deployment professional must use?
- A. 32 GB Memory, 16 CPU Cores
- B. 8 GB Memory, 4 CPU Cores
- C. 128 GB Memory, 16 CPU Cores
- D. 256 GB Memory, 32 CPU Cores
Answer: B
NEW QUESTION 25
A deployment professional needs to configure the X-Force Threat Intelligence Feed through a web proxy to access the cloud servers hosting the information.
How should the deployment professional configure the proxy for this access?
- A. Complete the 'System Proxy' values in the Advanced System Settings section of the Admin tab
- B. Edit the Vetc/httpd/conf.d/ssl.conf and Vopt/qradar/dca/server.ini' files on the Console and restart some services
- C. Complete the 'Server Config' values in the Advanced Update Configuration section of Auto Updates )
- D. Reconfigure iptables access on each managed host to provide access to 'update.xforce-security.com' and
'license.xforce-security.com' and restart some services
Answer: A
NEW QUESTION 26
A deployment professional needs to include a network inspection device in a banking organization as per the new security guidelines. Real time threat investigation has to be done along with the post-incident analysis. A QRadar Incident Forensics has been included in the design for post-incident forensic analysis.
Which devices should be chosen for the realtime analysis?
- A. Flow Collector (FC) and Flow Processor (FP)
- B. Flow Collector (FC) and QRadar Network Insight (QNI)
- C. Network PCAP and Flow Processor (FP)
- D. QRadar Network Insight (QNI) and Flow Processor (FP)
Answer: C
NEW QUESTION 27
......
Pass Your C1000-055 Exam Easily with Accurate PDF Questions: https://passguide.testkingpass.com/C1000-055-testking-dumps.html