EMT Practice Test

1. Question Content...

---

Question1: What app can be used in QRadar to visualize offenses, network data, threats, and malicious behavior provide insights and analysis about a network?

Question2: To increase the amount of storage for IBM Security QRadar, data is moved to an offboard storage device.
Which method for adding external storage must be used for /store/ariel?

Question3: A QRadar deployment professional wants to integrate a dynamic data set like asset information so that QRadar can use the latest information in the new data set to correlate the rules and alerts.
How can the deployment professional achieve this?

Question4: Before the creation of a new application instance with QRadar Assistant, with what entity must every application be associated?

Question5: Which two statements are prerequisites for an to upgrade of QRadar? (Choose two.)

Question6: In a multidomain and multitenant environment, how is event visibility provided to users?

Question7: What is an approach to tuning a "noisy" rule, that is, a rule that generates too many offenses?

Question8: Where is a QRadar license obtained?

Question9: What must a deployment professional select when defining a new flow source?

Question10: What must be done on all managed hosts after the restoration of a config backup on a new console?

Question11: Which two of these authentication types are valid for RADIUS authentication? (Choose two.)

Question12: What approach does QRadar take when it imposes EPS license (not hardware) limits on events that temporarily spike above that limit?

Question13: Which of these views is provided by the DSM Editor?

Question14: Which type of network hierarchy can be configured in QRadar?

Question15: On a Microsoft Windows 2019 server, a WinCollect agent is installed, which polls events locally. Its profile is set to Maximum EPS and the average EPS is 5000.
What is the minimum RAM requirement for this Windows 2019 server?

Question16: What must be created before the Use Case Manager app can be used?

Question17: The Server Discovery process updates building blocks based on which of these?

Question18: A QRadar deployment professional is asked to migrate the configuration of a system from Log Manager to QRadar SIEM.
How should the custom rules, saved searches, and reports be migrated?

Question19: An authentication token is generated on the QRadar Console for WinCollect agent installation.
What kind of WinCollect agent needs an authentication token?

Question20: Which industry standard security framework is incorporated into the QRadar 7.4.3 environment, which allows the QRadar deployment professional to link rules and building blocks to coverage in the framework?

Question21: Which statement about the Extensions Management tool in QRadar is true?

Question22: The /store for a QRadar HA setup was migrated to a Fibre Channel device. High Availability is not needed on this cluster, and it needs to be disconnected.
What changes are required before disconnecting the HA cluster in this scenario?

Question23: For the management of applications with Qradar Assistant, which of these is not an option?