C2150-624 Online Practice Questions and Answers

What is a precaution an Administrator should take before beginning an upgrade of IBM Security QRadar SIEM V7.2.8?

A. Close all open offenses.

B. Purge old data and events.

C. Check and close all open messages.

D. Confirm that a backup of the data is complete.

When an IBM Security QRadar SIEM V7.2.8 distributed deployment requires scaling horizontally to achieve Event per Second (EPS) requirements, what QRadar Component needs to be added to meet the EPS demands?

A. Event Manager

B. Event Indexing

C. Event Collector

D. Event Processor

An IBM Security QRadar SIEM V7.2.8 Administrator needs to download a nightly configuration backup file

from a past day through the Web Console.

Which steps must be followed to achieve this?

A. Admin Tab -> System Configuration -> Backup and Recovery -> Generate new backup -> Save

B. Admin Tab -> System Configuration -> Backup and Recovery ->Choose the name of an Existing backup

C. Admin Tab -> System Configuration -> Backup and Recovery -> Import New Backup -> Select file extension -> Save

D. Admin Tab -> System Configuration -> System Settings -> Database Settings -> Choose the name of an Existing backup

An Administrator is tasked with installing additional log sources into an IBM Security QRadar SIEM V7.2.8

deployment, bringing the total number of log source to 900. The deployment is using the default license

and the Administrator is getting an error attempting to add these additional log sources.

Why is this error happening?

A. The default license only allows 250 log sources.

B. The default license only allows 500 log sources.

C. The default license only allows 750 log sources.

D. The default license only allows 800 log sources.

An Administrator working with IBM Security QRadar SIEM V7.2.8 is constantly receiving the following

message:

"SAR Sentinal: Threshold crossed."

Where will the Administrator tune the settings for these messages?

A. Admin tab -> General Settings -> Global System Notifications

B. Admin tab -> System Configuration -> Global System Notifications

C. Admin tab -> System Notifications -> System Activity Reporter Notifications

D. Admin tab -> System Configuration -> General Settings -> System Notifications

An Administrator needs to create a new user role in the IBM Security QRadar SIEM V7.2.8 system. What steps need to be followed?

A. System Configuration tab -> Users and Roles -> Add New Role -> Add

B. Admin tab -> System Configuration -> User Management -> User Roles -> New

C. Admin tab -> System and Settings -> Users and Roles -> Role Management -> New

D. System Management tab -> System Configuration -> User Management -> User Roles -> New

Which query, when run from IBM Security QRadar SIEM V7.2.8, will show EPS for log sources?

A. select logsourcename(logsourceid) as LogSource, sum(eventcount) / ((max(endTime) - min (startTime)) / 1000) as EPS from events group by logsourceid order by EPS desc last 24 hours

B. select logsourcename(logsourceqid) as LogSource, sum(eventcount) / ((max(endTime) - min (startTime)) / 1000) as EPS from events group by logsourceqid order by EPS desc last 24 hours

C. select logsourcename(logsourceid) as LogSource, sum(eventcount) / ((max(endTime) - min (startTime)) / 1000) as FPS from events group by logsourceid order by EPS desc last 24 hours

D. select logsourcename(logsourceid) as LogSource, sum(eventcount) / ((max(endTime) - min (startTime)) / 1000) as EPS from events group by logsourceid order by FPS desc last 24 hours

An Administrator working with IBM Security QRadar SIEM V7.2.8 has to add a new host name to a

reference set with the name "Allowed Hosts" from the command line interface.

Which command would accomplish this task?

A. ./ReferenceSetUtil.sh add Allowed\ Hosts computer.domain.com

B. ./UtilReferenceSet.sh add "Allowed Hosts" "computer.domain.com"

C. ./UtilReferenceSet.sh update Allowed\ Hosts "computer.domain.com"

D. ./ReferenceSetUtil.sh update "Allowed Hosts" "computer.domain.com"

An IBM Security QRadar SIEM V7.2.8 deployment configured with High-Availability (HA) has both a

primary and secondary host. The administrator needs to test the operation of the primary high-availability

(HA) host automatic failover to the secondary HA host.

What must be configured to accomplish this test?

A. Configure the time interval of heartbeat timeout tests so the secondary HA host receives a response from the primary HA host within 2 minutes.

B. Configure the time interval of heartbeat timeout tests so the secondary HA host does not receive a response from the primary HA host within 2 minutes.

C. Configure the time interval of heartbeat ping tests so the secondary HA host receives a response from the primary HA host within a preconfigured time period.

D. Configure the time interval of the heartbeat ping tests so the secondary HA host does not receive a response from the primary HA host within a preconfigured time period.

Which is an officially supported web browser for managing IBM Security QRadar SIEM V7.2.8?

A. Safari

B. Vivaldi

C. Opera Netscape

D. Mozilla Firefox ESR