Question 1

An administrator wants to export a list of events to a CSV file. Which items are in the default columns of the search result?

Options :

A : Log Source. Event Count. High Level Category. Related Offense

B : Event Name. Application, Username, Log Source

C : Username. Source Port. Event Count, Magnitude

D : Protocol. Storage Time, Destination Port, Source Port

Answer: A

Question 2

Which service is responsible for adding new assets in Qradar ?

Options :

A : ecs-ep

B : ecs-ec

C : Asset Profiler

D : Vulnerability Information Server

Answer: C

Question 3

Which QRadar app displays time series graphs for queries?

Options :

A : Log Management App

B : Assistant for Watson

C : Pulse

D : Threat Intelligence

Answer: C

Question 4

An administrator needs to decommission an App Host. What is the proper order of events to ensure a successful removal?

Options :

A : Migrate applications to the Console>Ensure that all applications are working on the Console> Remove the App Host>Shut down the App Host

B : Ensure that all applications are working on the Console>Migrate applications to the Console> Remove the App Host>Shut down the App Host

C : Shut down the App Host>Migrate applications to the Console>Ensure that all applications are working on the Console> Remove the App Host

D : Migrate applications to the Console>Shut down the App Host> Remove the App Host>Shut down the App Host>Ensure that all applications are working on the Console

Answer: A

Question 5

An offense remains in a dormant state for __________days.

Options :

A : 10

B : 5

C : 15

D : 30

Answer: B

Higher Test Marks with Free Online C1000-156 Exam Practice

Buying Options: