Question 1

What is a reason for restarting hostcontext service in QRadar?

Options :

A :

A new app was installed

B : A new user was created and it needs to be replicated

C : The host is not responding to deploy requests

D : A new network hierarchy was uploaded

Answer: C

Question 2

An administrator wants to export a list of events to a CSV file. Which items are in the default columns of the search result?

Options :

A : Log Source. Event Count. High Level Category. Related Offense

B : Event Name. Application, Username, Log Source

C : Username. Source Port. Event Count, Magnitude

D : Protocol. Storage Time, Destination Port, Source Port

Answer: A

Question 3

One data gateway appliance can collect up to ____ number of EPS.

Options :

A : 30000

B : 5000

C : 20000

D : 10000

E :

15000

Answer: C

Question 4

A QRadar administrator recently installed a QRadar content pack that comes shipped with a custom Pulse dashboard. What does the administrator do to make the new dashboard available in the Pulse application?

Options :

A : Use the Synchronize function of the Pulse app in the Admin tab

B : Use the interactive API to add the dashboard to the list of available dashboards

C : After the administrator installs the content pack, the new dashboard automatically becomes available

D : Run the console script SynchronizePulseDashboards.sh after every content pack installation

Answer: A

Question 5

Which parameters can you use as a base for offense indexing?

Options :

A : Only predefined normalized properties

B : Only Username, Destination IP, and Source IP

C : Indexed customer properties

D : Any event property

Answer: D

Higher Test Marks with Free Online C1000-156 Exam Practice

Buying Options: