Question 1

When using the Dynamic Search window on the Admin tab, which two (2) data sources are available?

Options :

A : ASSETS

B : PAYLOAD

C : OFFENSES

D : AOL QUERY

E : SAVED SEARCHES

Answer: A,C

Question 2

A Security Analyst has noticed that an offense has been marked inactive. How long had the offense been open since it had last been updated with new events or flows?

Options :

A : 1 day + 30 minutes

B : 5 days + 30 minutes

C : 10 days + 30 minutes

D : 30 days + 30 minutes

Answer: B

Question 3

What is the primary use of viewing the Magnitude metric on the Offenses tab?

Options :

A : Determine which events to investigate last.

B : Determine the credibility rating that is configured in the log source.

C : Understand the type of offense we are facing.

D : Identify the importance of the offense in your environment.

Answer: D

Question 4

An analyst wishes to review an event which has a rules test against both event and flow data. What kind of rule is this?

Options :

A : Anomaly rules

B : Threshold rules

C : Offense rules

D : Common rules

Answer: A

Question 5

Which parameters are used to calculate the magnitude rating of an offense?

Options :

A : Relevance, credibility, time

B : Severity, relevance, credibility

C : Relevance, urgency, credibility

D : Severity, impact, urgency

Answer: B

Higher Test Marks with Free Online C1000-162 Exam Practice

Buying Options: