EMT Practice Test

1. Question Content...

---

Question1: Which log source and protocol combination delivers events to QRadar in real time?

Question2: How can adding indexed properties to QRadar improve the efficiency of searches?

Question3: A Security Analyst was asked to search for an offense on a specific day. The requester was not sore of the time frame, but had Source Host information to use as well as networks involved, Destination IP and username.
Which fitters can the Security Analyst use to search for the information requested?

Question4: The Pulse app contains which two (2) widget chart types?

Question5: What is the effect of toggling the Global/Local option to Global in a Custom Rule?

Question6: A QRadar analyst wants to limit the time period for which an AOL query is evaluated. Which functions and clauses could be used for this?

Question7: Select all that apply
What is the sequence to create and save a new search called "Offense Data" that shows all the CRE events that are associated with offenses?

Question8: A task is set up to identify events that were missed by the Custom Rule Engine. Which two (2) types of events does an analyst look for?

Question9: In QRadar. what do event rules test against?

Question10: When searching for all events related to "Login Failure", which parameter should a security analyst use to filter the events?

Question11: What type of custom property should be used when an analyst wants to combine extraction-based URLs, virus names, and secondary user names into a single property?

Question12: What happens when you select "False Positive" from the right-click menu in the Log Activity tab?

Question13: Which QRadar component provides the user interface that delivers real-time flow views?

Question14: How can an analyst search for all events that include the keyword "access"?

Question15: On which lab can an analyst perform a "Flow Bias" Quick Search?

Question16: What is the default number of notifications that the System Notification dashboard can display?

Question17: Which of these statements regarding the deletion of a generated content report is true?

Question18: In Rule Response, which two (2) options are available for Offense Naming?

Question19: After how much time will QRadar mark an Event offense dormant if no new events or flows occur?

Question20: Which two (2) components are necessary for generating a report using the QRadar Report wizard?

Question21: Which type of rule requires a saved search that must be grouped around a common parameter

Question22: On the Offenses tab, which column explains the cause of the offense?

Question23: QRadar analysts can download different types of content extensions from the IBM X-Force Exchange portal. Which two (2) types of content extensions are supported by QRadar?

Question24: Which reference set data element attribute governs who can view its value?

Question25: A mapping of a username to a user's manager can be stored in a Reference Table and output in a search or a report.
Which mechanism could be used to do this?

Question26: Reports can be generated by using which file formats in QRadar?

Question27: What feature in QRadar uses existing asset profile data so administrators can define unknown server types and assign them to a server definition in building blocks and in the network hierarchy?

Question28: A Security Analyst has noticed that an offense has been marked inactive.
How long had the offense been open since it had last been updated with new events or flows?

Question29: Which parameters are used to calculate the magnitude rating of an offense?

Question30: Which flow fields should be used to determine how long a session has been active on a network?

Question31: Which type of rule should you use to test events or (lows for activities that are greater than or less than a specified range?

Question32: What are two characteristics of a SIEM? (Choose two.)