EMT Practice Test

1. Question Content...

---

Question1: A QRadar user reported the following notification:
38750099 - The accumulator was unable to aggregate all events/flows for this interval When does this message appear?

Question2: An administrator needs to know if a custom rule is being correlated correctly.
Which QRadar component is responsible for this process?

Question3: An administrator needs to add the following networks to a QRadar network hierarchy as a single Classless Inter-Domain Routin (CIDR) range:
192.168.64.0/24
192.168.65.0/24
192.168.66.0/24
192.168.67.0/24
What is the correct supernet for these subnets?

Question4: An administrator enters the QRadar web console into a web browser but does not get a response.
Which process is responsible for the QRadar GUI?

Question5: A custom rule is generating events reporting that a specific user is failing to login too many times in the last 5 minutes. The administrator opens the event details to investigate the anomaly associated with the events but finds that no Anomaly details pane is shown.
What is the reason?
The events were generated by:

Question6: What is a reason for restarting hostcontext service in QRadar?

Question7: An administrator needs to add, delete and modify user accounts.
When deleting a user, what dependency checks are carried out?

Question8: An administrator needs to import a list of HR staff logins into a reference set.
Which file type can be used with the import function in the reference set editor window?

Question9: An administrator wants to upload a file with information related to network hierarchy instead of using the GUI wizard.
How can the administrator do this?

Question10: An administrator installed a new App Host and would like to move the existing applications from the Console to the App Host.
What steps should be performed?

Question11: An administrator needs to combine multiple extraction and calculation-based properties into a single property.
Which Ariel Query Language (AQL) statement can be used?

Question12: An administrator is seeing the following system notification:
38750057 - A protocol source configuration may be stopping events from being collected.
What is a valid user action to this issue?

Question13: Which IBM monitoring application can be used to see detailed health and status information at the application, middleware, and system level?

Question14: An administrator has to change the system hardware clock of the QRadar server. The administrator has already restarted the main services (hostservices, tomcat, hostcontext) and needs to synchronize the QRadar Console time with the QRadar managed hosts.
Which command can the administrator use to accomplish this?

Question15: An administrator needs to develop advanced filters to retrieve information from the QRadar System pertaining to the top abnormal events of the most bandwidth-intensive IP addresses.
How can the administrator do this?

Question16: An administrator has been tasked to create a saved search that shows a list of multiple login failures for a single user by username. The administrator has done the following:
1. Selected Last Hour in the view option.
2. In the Add filter window, selected the search parameter Custom Rule [Indexed].
3. Selected Equals for Operator.
4. Selected Authentication for Rule Group.
What is the next step the administrator needs to perform for the Rule option?

Question17: An administrator logs in to the Offenses tab and finds a large number of new Offenses that need action.
What column in the list of Offenses should the administrator use to prioritize them?

Question18: A QRadar upgrade is planned and a maintenance window is scheduled. The administrator must stage the FIXPACK from IBM Fix Central.
Which QRadar FIXPACK file type must the administrator download?

Question19: An administrator receives an expensive custom rule notification.
Which tool can now be enabled via the Advanced 'System Settings' - Custom Rule Settings to help troubleshoot this?

Question20: To comply with specific regulations, an administrator has been requested to increase asset retention to 365 days.
In which QRadar section can the administrator find the asset retention settings?

Question21: What happens if QRadar receives events at a higher rate than the license allows?