EMT Practice Test

1. Question Content...

---

Question1: Which flow fields should be used to determine how long a session has been active on a network?

Question2: To verify whether the login ID that was used to log in to QRadar is assigned to a user, create a list with the LoginlD parameter.
This example refers to what kind of reference data collections?

Question3: Which two (2) types of data can be displayed by default in the Application Overview dashboard?

Question4: Create a list that stores Username as the first key. Source IP as the second key with an assigned cidr data type, and Source Port as the value.
The example above refers to what kind of reference data collections?

Question5: Which IBM X-Force Exchange feature could be used to query QRadar to see if any of the lOCs were detected for COVID-19 activities?

Question6: Offense chaining is based on which field that is specified in the rule?

Question7: How can adding indexed properties to QRadar improve the efficiency of searches?

Question8: Which two (2) options are used to search offense data on the By Networks page?

Question9: When you create a report, you must choose a chart type for each chart that is included in the report.
Which two (2) chart types can you include in a report?

Question10: Which are two (2) types of charts that can be configured in QRadar to display data on the dashboard?
azureindia.starttest.com says

Question11: A QRadar analyst wants to limit the time period for which an AOL query is evaluated. Which functions and clauses could be used for this?

Question12: Which two (2) of these elements can be used by the Report wizard to design a report?

Question13: Which log source and protocol combination delivers events to QRadar in real time?

Question14: What is the default number of notifications that the System Notification dashboard can display?

Question15: Which parameter is calculated based on the relevance, severity, and credibility of an offense?

Question16: What does this example of a YARA rule represent?
rule ibm_forensics : qradar
meta:
description = "Complex Yara rule."
strings:
Shexl = {4D 2B 68 00 ?? 14 99 F9 B? 00 30 Cl 8D}
Sstrl = "IBM Security!"
condition:
Shexl and (#strl > 3)

Question17: Which two (2) are valid options available for configuring the frequency of report execution in the QRadar Report wizard?

Question18: A task is set up to identify events that were missed by the Custom Rule Engine. Which two (2) types of events does an analyst look for?

Question19: What does the logical operator != in an AQL query do?

Question20: Which parameters are used to calculate the magnitude rating of an offense?

Question21: After how much time will QRadar mark an Event offense dormant if no new events or flows occur?

Question22: Which statement regarding the time series chart is true?

Question23: What are two characteristics of a SIEM? (Choose two.)

Question24: What type of reference data collection would you use to correlate a unique key to a value?

Question25: How long does QRadar store payload indexes by default?

Question26: An analyst is looking at flow payload. The analyst noted the payload is truncated.
|at default value size for the payload is exceeded where the payload might contain additional information that is not shown in the QRadar surface?

Question27: What types of data does a Quick filter search operate on?

Question28: A Security Analyst has noticed that an offense has been marked inactive.
How long had the offense been open since it had last been updated with new events or flows?

Question29: How can an analyst search for all events that include the keyword "access"?

Question30: Which property types can be used to reduce the overall data volume searched and shorten search time to address searches taking longer than expected?

Question31: QRadar analysts can download different types of content extensions from the IBM X-Force Exchange portal.
Which two (2) types of content extensions are supported by QRadar?

Question32: Many offenses are generated and an analyst confirms that they match some kind of vulnerability scanning.
Which building block group needs to be updated to include the source IP of the vulnerability assessment (VA) scanner to reduce the number of offenses that are being generated?

Question33: What is the name of the data collection set used in QRadar that can be populated with lOCs or other external data?

Question34: When an analyst is investigating an offense, what is the property that specifies the device that attempts to breach the security of a component on the network?

Question35: After conducting a thorough analysis, it was discovered that the traffic generated by an attacker targeting one system through many unique events in different categories is legitimate and should not be classified as an offense.
Which tuning methodology guideline can be used to tune out this traffic?

Question36: Which two (2) dashboards in the Pulse app by default?

Question37: New vulnerability scanners are deployed in the company's infrastructure and generate a high number of offenses. Which function in the Use Case Manager app does an analyst use to update the list of vulnerability scanners?

Question38: Which two (2) aggregation types ate available for the pie chart in the Pulse app?

Question39: When searching for all events related to "Login Failure", which parameter should a security analyst use to filter the events?

Question40: A mapping of a username to a user's manager can be stored in a Reference Table and output in a search or a report.
Which mechanism could be used to do this?

Question41: Reports can be generated by using which file formats in QRadar?

Question42: An analyst runs a search with correct AQL. but no errors or results are shown.
What is one reason this could occur?

Question43: What type of rules will test events or flows for volume changes that occur in regular patterns to detect outliers?

Question44: Which type of rule requires a saved search that must be grouped around a common parameter

Question45: Which parameter should be used if a security analyst needs to filter events based on the time when they occurred on the endpoints?

Question46: Select all that apply
What is the sequence to create and save a new search called "Offense Data" that shows all the CRE events that are associated with offenses?

Question47: How do events appear in QRadar if there was an error in the JSON parser for a new log source to which a custom log source extension was created?

Question48: Which two (2) types of categories comprise events?

Question49: Which of these statements regarding the deletion of a generated content report is true?

Question50: A QRadar analyst develops an advanced search on the Log Activity tab and presses the shortcut "Ctrl + Space" in the search field. What information is displayed?

Question51: Which two (2) tasks are uses of the QRadar network hierarchy?

Question52: After analyzing an active offense where many source systems were observed connecting to a specific destination via local-to-local LDAP traffic, an ^lyst discovered that the targeted system is a legitimate LDAP server within the organization.
x avoid confusion in future analyses, how can this type of traffic to the target system be flagged as expected and be excluded from further offense ation?

Question53: An analyst wishes to review an event which has a rules test against both event and flow data.
What kind of rule is this?

Question54: Which two (2) values are valid for the Offense Type field when a search is performed in the My Offenses or All Offenses tabs?

Question55: A QRadar analyst is investigating the events of an offense. For a particular event on the list, the analyst wants to know which rules were fully ditched for the event.
where can the analyst check to see if the event has any fully matched rules?

Question56: What is the primary use of viewing the Magnitude metric on the Offenses tab?

Question57: What does an analyst need to do before configuring the QRadar Use Case Manager app?

Question58: A QRadar analyst wants predefined searches, reports, custom rules, and custom properties for HIPAA compliance.
Which option does the QRadar analyst use to look for HIPAA compliance on QRadar?

Question59: Which browser is officially supported for QRadar?

Question60: What is the effect of toggling the Global/Local option to Global in a Custom Rule?

Question61: Which two (2) of these custom property expression types are supported in QRadar?

Question62: An analyst must create a reference set collection containing the IPv6 addresses of command-and-control servers in an IBM X-Force Exchange collection in order to write a rule to detect any enterprise traffic with those malicious IP addresses.
What value type should the analyst select for the reference set?

Question63: An analyst wants to share a dashboard in the Pulse app with colleagues.
The analyst exports the dashboard by using which format?

Question64: What Is the result of the following AQL statement?

Question65: a selection of events for further investigation to somebody who does not have access to the QRadar system.
Which of these approaches provides an accurate copy of the required data in a readable format?