Question 1

What is a reason for restarting hostcontext service in QRadar?

Options :

A :

A new app was installed

B : A new user was created and it needs to be replicated

C : The host is not responding to deploy requests

D : A new network hierarchy was uploaded

Answer: C

Question 2

You set up a new source that uses syslog to send events to an event collector (EC). You note that no data is collected from this source, but other syslog sources configured the same way work fine. Which tool can you use to troubleshoot whether the syslog data has reached the EC?

Options :

A : nslookup

B : tcpdump

C : ssh

D : netstat

Answer: B

Question 3

Which parameters can you use as a base for offense indexing?

Options :

A : Only predefined normalized properties

B : Only Username, Destination IP, and Source IP

C : Indexed customer properties

D : Any event property

Answer: D

Question 4

A QRadar administrator recently installed a QRadar content pack that comes shipped with a custom Pulse dashboard. What does the administrator do to make the new dashboard available in the Pulse application?

Options :

A : Use the Synchronize function of the Pulse app in the Admin tab

B : Use the interactive API to add the dashboard to the list of available dashboards

C : After the administrator installs the content pack, the new dashboard automatically becomes available

D : Run the console script SynchronizePulseDashboards.sh after every content pack installation

Answer: A

Question 5

An administrator plans to deploy multiple log sources that share a common configuration. How many log sources can be added at one time?

Options :

A : 750

B : 500

C :

1000

D :

250

Answer: B

Higher Test Marks with Free Online C1000-156 Exam Practice

Buying Options: