EMT Practice Test

1. Question Content...

---

Question1: The deployment professional needs to pull events from an HR system that are recorded in a database. Which protocol would be used to collect the data?

Question2: A deployment professional sees that there are occasional spikes in the EPS (Events per second). The host has
1000 EPS allocated but the occasional spikes go up to 1185 EPS.
What happens with the events when they go over the allocated amount?

Question3: A deployment professional needs to configure the IBM QRadar systems so that data is forwarded to one or more vendor systems, such as ticketing or alerting systems.
Which event format options can the deployment professional use for forwarding destination configuration?

Question4: A deployment professional receives instructions to virtualize the currently installed QRadar SIEM All-in-One appliance and to provide requirements. VM specifications must suffice for 4000 EPS.
What are the minimum processor and memory requirements that the deployment professional must use?

Question5: A deployment professional has been asked to ensure that the system has access to information which can be used by rules to acquire information extracted from a user information source such as Active Directory or LDAP.
Which information repository should the deployment professional store this data in?

Question6: A client uses the IBM Security QRadar Vulnerability Manager to discover vulnerabilities on the network devices, applications, and software. They run the QRadar Vulnerability Manager from an All-in-one system, where the scanning and processing functions are on the Console. As the client's QRadar deployment is growing, they are also considering deploying scanners.
What is a valid client motivation for deploying additional scanners?

Question7: A company is currently using 2500 EPS (events per second). A deployment professional is required to plan for a large reorganization project within the company that would increase the EPS to 7500 for 5 months.
What type of licensing should the deployment professional choose?

Question8: A deployment professional just installed new QRadar deployment which comes with a temporary license key.
How many days does a deployment professional have before the temporarylicensekey expires?

Question9: A deployment professional needs to configure network devices to send IPFIX to a QRadar deployment consisting of 1 QRadar Console 3129 and 2 QRadar Event Processors 1629. The routers will send more than 1
000 000 FPM.
Which component should be added to the existing deployment?

Question10: IBM Security QRadar initiates a sequence of events when a primary high-availability (HA) host fails. During failover, the secondary HA host assumes the responsibilities of the primary HA host. The following actions are completed.
1.1. If configured, external shared storage devices are detected and the file systems are mounted.
2. 2. The secondary HA host connects to the console and downloads configuration files.
3. 3. A management interface network alias is created, for example, the network alias for ethO is ethO:0.
4. 4. The cluster virtual IP address is assigned to the network alias.
5. 5. All QRadar services are started.
What is the order of the sequence?

Question11: The client implemented a QRadar Network Insights (QNI), and is looking to add post-incident investigations and threat hunting activities.
What should the deployment professional recommend?

Question12: An application developer is working on a reporting tool that fetches and visualizes data from multiple data sources. The deployment professional is asked to explain how to make authenticated requests on QRadar using its REST API interface.
Which authentication method is supported by QRadar's REST API?

Question13: A customer has a Network Vulnerability Scanner which is not supported by IBM QRadar.
How can a deployment professional integrate such a scanner with IBM QRadar?

Question14: A customer needs to increase the storage space that is available to an Event Processor and be able to speed up historical searches.
Which solution should the deployment professional recommend?

Question15: A systems team has configured their application to send syslog via tcp to a QRadar event collector. The deployment professional has noted that no such logs have arrived for the pre-defined log source.
To troubleshoot this and to prove this traffic has/has not arrived at the event collector, what command can be used from the event collector CLI?
(The Device_Address is an IPv4 address or a host name)

Question16: A company that is located in the United States wants to expand its existing QRadar deployment to data centers located in Europe. The European branch needs to keep its data in-country and must comply with local data retention regulations.
What can the deployment professional do to comply with local data laws?

Question17: What are anomaly detection rules used for?

Question18: A deployment professional is faced with the following system notification.
38750107 - The last attempt to read in rules (usually due to a rule change) has failed. Please see the message details and error log for information on how to resolve this.
What should the deployment professional do after trying to disable and enabling the rule?

Question19: A deployment professional needs to ensure that in high-security unidirectional networks (also known as data diodes), logs are collected from different log sources.
Which option should the deployment professional use?

Question20: A company has a large network with multiple segments. The manufacturing area network and the research and development (R&D) area network are separated from the product area network, and the customer does not want to run scanners through firewalls. A deployment professional has been tasked with proposing a strategy to ensure vulnerability assessment operations cover all company assets.
In addition to a scanner in the production area network, which option should the deployment professional follow?

Question21: A deployment professional needs to include a network inspection device in a banking organization as per the new security guidelines. Real time threat investigation has to be done along with the post-incident analysis. A QRadar Incident Forensics has been included in the design for post-incident forensic analysis.
Which devices should be chosen for the realtime analysis?