Question 1

You set up a new source that uses syslog to send events to an event collector (EC). You note that no data is collected from this source, but other syslog sources configured the same way work fine. Which tool can you use to troubleshoot whether the syslog data has reached the EC?

Options :

A : nslookup

B : tcpdump

C : ssh

D : netstat

Answer: B

Question 2

An administrator has been asked to configure a new QRadar console high availability (HA) deployment. Both the primary and secondary consoles have been installed with the QRadar software. What should the administrator do to complete the HA configuration?

Options :

A : Reinstall the QRadar software on the secondary console using an ג€HA Recovery Setupג€.

B : Add the secondary console to the deployment, and then create the HA host.

C : Create the HA host to add the secondary console to the deployment.

D : Select ג€Secondary Hostג€ on the wizard when adding the secondary host to the deployment.

Answer: B

Question 3

On a QRadar appliance, you might see a warning that you cannot connect to port 32006. Which command you will use for determining port information?

Options :

A : netstat

B : nc

C : nmap

D : psexec

Answer: A

Question 4

Which QRadar app displays time series graphs for queries?

Options :

A : Log Management App

B : Assistant for Watson

C : Pulse

D : Threat Intelligence

Answer: C

Question 5

Which framework can be visualized from the Use Case Manager application?

Options :

A :

MITRE ATT&CK

B : Lockheed Martin Cyber Kill Chain

C : NIST 800-53

D : Diamond Model of Intrusion Analysis

Answer: A

Higher Test Marks with Free Online C1000-156 Exam Practice

Buying Options: