QUESTION 1An IBM Security QRadar SIEM V7.2.8 Administrator needs to retain authentication failure data to a specificdomain, for a longer period than the rest of the event data being collected.
How is this task completed?
A. The administrator will need to create a custom rule with the appropriate filters and retention period.
B. The administrator will need to create a new Event Retention Bucket with the appropriate filters and retention period.
C. The administrator will need to create a custom filter in the log activity tab with the appropriate parametersand retention period.
D. The administrator will need to create a custom report with the appropriate parameters and use the reportformat TAR (Tape archive).
Answer: B
Explanation:In current versions of QRadar you can set custom retention buckets for Events and Flows. The 10 non-defaultretention buckets are processed sequentially from top to bottom. Any events that do not match the retentionbuckets are automatically placed in the default retention bucket, located at the bottom of the list. Customretention buckets allow the ability to add a time period and filters. If you enable a retention bucket with adefined criteria it will start deleting data from the time is was created. Any data that matches the customretention bucket before it was created is subject to the criteria of the default retention bucket setting.
If youneed to delete data from before the Custom retention bucket was created you can shorten the defaultretention bucket so data is deleted immediately.
Referencehttp://www-01.ibm.com/support/docview.wss?uid=swg21622758
C2150-624 exam dumps pdf, C2150-624 practice test, exam C2150-624 sample questions
QUESTION 2What is the Events Per Second (EPS) basic license limit in an IBM Security QRadar V7.2.8 2100 hardwareappliance?
A. 200
B. 1000
C. 2500
D. 10000
Answer: C
Explanation:Referenceftp://ftp.software.ibm.com/software/security/products/qradar/documents/7.2.8/en/b_QRadar_hardware_guide.pdf
QUESTION 3An Administrator working with IBM Security QRadar SIEM V7.2.8 only needs to remove a single host (10.1.95.142) from the reference set with the name “Asset Reconciliation IPv4 Whitelist” from the command line interface.
Which command would accomplish this task?
A. ./RefereceSetUtil.sh purge Asset\ Reconciliation\ IPv4\ Whitelist 10.1.95.142
B. ./RefereceSetUtil.sh delete Asset\ Reconciliation\ IPv4\ Whitelist 10.1.95.142
C. ./RefereceSetData.sh purge Asset\ Reconciliation\ IPv4\ Whitelist 10.1.95.142
D. ./RefereceSetData.sh delete Asset\ Reconciliation\ IPv4\ Whitelist 10.1.95.142
Answer: B
Explanation:The syntax for the command is: ReferenceSetUtil.sh add "Asset Reconciliation IPv4 Whitelist" IP
Referencehttp://www.juniper.net/techpubs/en_US/jsa2014.8/informationproducts/topiccollections/jsaadministration-guide.pdf
IBM Security QRadar SIEM V7.2.8 Fundamental Administration - 100% Pass Guarantee
QUESTION 4An Administrators will add a secondary host to an IBM Security QRadar SIEM V7.2.8 Console in a High Availability (HA) deployment scenario.
After checking the compatibility between primary and secondary HA pairs, what other prerequisite should the Administrator check within Managed Interfaces?
A. The shared external storage.
B. The server certificate that is issued by the local CA.
C. The existence of an additional distributed file system.
D. The communication for Distributed Replicated Block Device.
Answer: D
Explanation:
CP port 7789 must be open and allow communication between the primary and secondary for Distributed Replicated Block Device (DRBD) traffic.
DRBD traffic is responsible for disk replication and is bidirectional between the primary and secondary host.
Referencehttps://www.ibm.com/support/knowledgecenter/SS42VS_7.2.7/com.ibm.qradar.doc/c_qradar_appliance_require.html
QUESTION 5An IBM Security QRadar SIEM V7.2.8 Administrator needs to check if the “hostcontext” process is running.
How can the Administrator do this?
A. hostcontext status
B. status hostcontext service
C. service hostcontext status
D. /etc/qradar/hostcontext status
Answer: C
Explanation:Referencehttp://qradar360.blogspot.com/p/guides-material.html
