EMT Practice Test

1. Question Content...

---

Question1: Which two (2) columns are valid for searches in the My Offenses and All Offenses tabs in QRadar?

Question2: Which flow fields should be used to determine how long a session has been active on a network?

Question3: How can an analyst identify the top rules that generated offenses in the previous week and were closed as false positives or tuned?

Question4: A QRadar analyst wants to limit the time period for which an AOL query is evaluated. Which functions and clauses could be used for this?

Question5: Reports can be generated by using which file formats in QRadar?

Question6: An analyst must create a reference set collection containing the IPv6 addresses of command-and-control servers in an IBM X-Force Exchange collection in order to write a rule to detect any enterprise traffic with those malicious IP addresses.
What value type should the analyst select for the reference set?

Question7: Which are types of reference data collections in QRadar?

Question8: Which parameters are used to calculate the magnitude rating of an offense?

Question9: The Use Case Manager app has an option to see MITRE heat map.
Which two (2) factors are responsible for the different colors in MITRE heat map?

Question10: Which kind of information do log sources provide?

Question11: Which two (2) aggregation types are available for the pie chart in the Pulse app?

Question12: New vulnerability scanners are deployed in the company's infrastructure and generate a high number of offenses. Which function in the Use Case Manager app does an analyst use to update the list of vulnerability scanners?

Question13: Which two (2) dashboards in the Pulse app by default?

Question14: What right-click menu option can an analyst use to find information about an IP or URL?

Question15: A Security Analyst was asked to search for an offense on a specific day. The requester was not sore of the time frame, but had Source Host information to use as well as networks involved, Destination IP and username.
Which fitters can the Security Analyst use to search for the information requested?

Question16: Which two (2) values are valid for the Offense Type field when a search is performed in the My Offenses or All Offenses tabs?

Question17: Which two (2) statements regarding indexed custom event properties are true?

Question18: Which two (2) of these custom property expression types are supported in QRadar?

Question19: How long will an AQL statement remain in execution if a time criteria is not specified, such as start, end, or last?

Question20: After conducting a thorough analysis, it was discovered that the traffic generated by an attacker targeting one system through many unique events in different categories is legitimate and should not be classified as an offense.
Which tuning methodology guideline can be used to tune out this traffic?

Question21: Which two (2) types of data can be displayed by default in the Application Overview dashboard?

Question22: Which type of rule requires a saved search that must be grouped around a common parameter

Question23: Which parameters are used to calculate the magnitude rating of an offense?

Question24: An analyst wants to share a dashboard in the Pulse app with colleagues.
The analyst exports the dashboard by using which format?

Question25: What is the primary use of viewing the Magnitude metric on the Offenses tab?

Question26: To test for authorized access to a patent, create a list that uses a custom event property for Patent id as the key, and the username parameter as the value. Data is stored in records that map a key to multiple values and every key is unique. Use this list to populate a list of authorized users.
The example above refers to what kind of reference data collections?

Question27: Which two (2) tasks are uses of the QRadar network hierarchy?

Question28: How can an analyst improve the speed of searches in QRadar?

Question29: Which two (2) of these elements can be used by the Report wizard to design a report?

Question30: The Pulse app contains which two (2) widget chart types?

Question31: Which action is performed in Edit Search to create a report from Offense data?

Question32: What two (2) guidelines should you follow when you define your network hierarchy?

Question33: Which browser is officially supported for QRadar?

Question34: Where can you view a list of events associated with an offense in the Offense Summary window?

Question35: Which statement regarding saved event search criteria is true?

Question36: How does a Device Support Module (DSM) function?

Question37: What is the default number of notifications that the System Notification dashboard can display?

Question38: What does an analyst need to do before configuring the QRadar Use Case Manager app?

Question39: Which two (2) AQL functions are used for calculations and formatting?

Question40: A mapping of a username to a user's manager can be stored in a Reference Table and output in a search or a report.
Which mechanism could be used to do this?

Question41: AQRadar analyst can check the rule coverage of MITRE ATT&CK tactics and techniques by using Use Case Manager.
In the Use Case Manager app, how can a QRadar analyst check the offenses triggered and mapped to MITRE ATT&CK framework?

Question42: When investigating an offense, how does one find the number of flows or events associated with it?

Question43: An analyst wishes to review an event which has a rules test against both event and flow data.
What kind of rule is this?

Question44: On which lab can an analyst perform a "Flow Bias" Quick Search?

Question45: What does an analyst need to do before configuring the QRadar Use Case Manager app?

Question46: How does a QRadar analyst get to more information about a MITRE entry in the Use Case Manager?

Question47: Which two (2) options are used to search offense data on the By Networks page?

Question48: What can be considered a log source type?

Question49: What does the Next Run Time column display when a report is queued for generation in QRadar?

Question50: Which IBM X-Force Exchange feature could be used to query QRadar to see if any of the lOCs were detected for COVID-19 activities?

Question51: When searching for all events related to "Login Failure", which parameter should a security analyst use to filter the events?

Question52: What process is used to perform an IP address X-Force Exchange Lookup in QRadar?

Question53: What are two characteristics of a SIEM? (Choose two.)

Question54: A QRadar analyst develops an advanced search on the Log Activity tab and presses the shortcut "Ctrl + Space" in the search field. What information is displayed?

Question55: What is the difference between an unknown event and a stored event?

Question56: On the Dashboard tab in QRadar. dashboards update real-time data at what interval?

Question57: What does this example of a YARA rule represent?

Question58: Which two (2) aggregation types ate available for the pie chart in the Pulse app?

Question59: Which statement regarding the use of the internal structured language of the QRadar database is true?