C1000-026 Online Practice Questions and Answers

An administrator needs to import data into QRadar for a specific use case.

The data that has been provided to the administrator is stored in records that map a key to a value.

Which type of data collection must the administrator create?

A. Reference set

B. Reference map of sets

C. Reference map

D. Reference map of maps

An administrator needs to collect logs from the Command Line Interface (CLI). Which command should the administrator use?

A. /opt/bin/qradar/support/get_logs.sh

B. /opt/support/get_logs.sh

C. /opt/support/qradar/get_logs.sh

D. /opt/qradar/support/get_logs.sh

To comply with specific regulations, an administrator has been requested to increase asset retention to 365 days.

In which QRadar section can the administrator find the asset retention settings?

A. Admin Tab / Asset Retention

B. Assets Tab / Retention settings

C. Admin Tab / System settings

D. Assets Tab / Asset Retention

An administrator plans to deploy multiple log sources that share a common configuration.

How many log sources can be added at one time?

A. 1000

B. 750

C. 250 D. 500

Which log should be reviewed to determine the reasons a patch installer did not proceed during a QRadar upgrade?

A. /var/log/qradar.audit

B. /var/log/qradar.log

C. /var/log/setup-*/patches.log

D. /var/log/upgrade.log

An administrator modified a configuration setting in the Global System Notifications using the QRadar Console Admin tab.

What is the last step to apply changes?

A. Reload Web Server

B. Restart Services

C. Re-login to QRadar console

D. Deploy Changes

An administrator wants to have all QRadar apps running on a new App Host that was configured to have dedicated CPU, storage and memory resources for the Apps. Several issues were presented during the installation of the App Host.

To troubleshoot, what should the administrator check?

A. If the completion of the /opt/qradar/check_app_host.sh script was successful

B. If port 5000 is opened on the console

C. If an IP table entry was already created to allow traffic from the App Host IP

D. If IP tables are disabled on the console

An administrator has been tasked to run all health checks at once using the DrQ command before a major event happens, such as an upgrade.

What does the DrQ command do?

A. It runs all available checks in /opt/ibm/si/diagnostiq with the checkup mode and with the summary output mode.

B. It shows all the available drives on the QRadar managed host.

C. It runs all available checks in /opt/ibm/si/diagnostiq and writes the results in a txt file.

D. It checks all the available drives on the QRadar managed host and writes the results on a txt file.

An administrator would like to extend the functionality of QRadar using an external application.

Which file format is supported to successfully upload an application from the QRadar Console?

A. .zip

B. .tgz

C. .sh

D. .exe

An administrator installed a new App Host and would like to move the existing applications from the Console to the App Host.

What steps should be performed?

A. Admin Tab > Extension Management > Click to change where apps are run

B. Admin Tab > System Settings > Move apps

C. Admin Tab > Extension Management > Move apps

D. Admin Tab > System and License Management > Click to change where apps are run