EMT Practice Test

1. Question Content...

---

Question1: What is an approach to tuning a "noisy" rule, that is, a rule that generates too many offenses?

Question2: The Server Discovery process updates building blocks based on which of these?

Question3: What are the search options available for searching offense data on the By Networks page?

Question4: Retention buckets are sequenced in order. If a record matches all the filter criteria of multiple buckets, where is the record stored?

Question5: Consider this scenario and instruction.
Vulnerability assessment products launch attacks that can result in offense creation. To avoid this behavior and define vulnerability assessment products or any server that you want to ignore as a source, edit the "and when the source IP is one of the following" test to include the IP addresses of the following scanners.
- VA Scanners
- Authorized Scanners
What type of editable building block is described?

Question6: What must be done on all managed hosts after the restoration of a config backup on a new console?

Question7: During restoration of a configuration backup on the system in the Restore a Backup window, which is a parameter or item a QRadar specialist can select to be restored?

Question8: For tenant data retention, what is the maximum number of buckets for shared data that can be created per tenant?

Question9: From which tabs can a QRadar custom rule be created?

Question10: To install the 7.x WinCollect Configuration Console, which of these actions is a prerequisite?

Question11: How can you check the amount of used and available RAM on a QRadar appliance?

Question12: A QRadar user wants to edit a building block to include geographic locations that they want to prevent from accessing their network. The user will edit the "and when the source is located in" test in the building block.
Which building block will the user edit?

Question13: What is high-level view of the configuration restore process?

Question14: In a multidomain and multitenant environment, how is event visibility provided to users?

Question15: Reports can be organized into groups for efficient utilization.
What report groups are available by default in QRadar?

Question16: On a QRadar appliance, you might see a warning that you cannot connect to port 32006.
Which command you will use for determining port information?

Question17: Which two types of default building blocks do you need to edit to reduce the number of offenses that are generated by high volume traffic servers?

Question18: As a deployment professional, which product do you recommend to reconstruct the raw network data that is related to a security breach?

Question19: A large multinational corporation is expanding its QRadar deployment to new countries. They decided to implement a geographically distributed deployment.
What may be a benefit of having a processor on site, according to the scenario?

Question20: While reviewing apps in QRadar Assistant, an analyst wants to view the apps that work properly.
What sort option should the analyst choose?

Question21: While reviewing the performance of a QRadar distributed environment, you notice an abnormal number of events that were generated in the past 24 hours:
38750088 - Performance degradation has been detected in the event pipeline. Event(s) were routed directly to storage.
As a deployment professional, you ensure that your events per second (EPS) license is adequate and verify that no changes to rules or custom properties were made in the past week.
Which of these issues can cause QRadar to generate performance degradation events?

Question22: What must be created before the Use Case Manager app can be used?

Question23: Which of these is a valid CIDR length value to use when configuring the network hierarchy in QRadar?

Question24: During an App Host migration, a deployment professional needs to ensure that all the apps are stopped.
Which task will stop the apps from running?

Question25: Which of these items forwards data to a QRadar Packet Capture appliance?

Question26: A QRadar deployment professional is asked to migrate the configuration of a system from Log Manager to QRadar SIEM.
How should the custom rules, saved searches, and reports be migrated?

Question27: Which type of network hierarchy can be configured in QRadar?

Question28: When prioritizing offenses to investigate, what metric is provided on the Offenses tab specifically to help influence which offenses to investigate first?

Question29: Consider this description: Edit the and when either the source or destination IP is one of the following test to include the broadcast addresses of the network. This change removes false positive events that might be caused by the use of broadcast messages.
What type of editable building blocks is described?

Question30: Which module can be used when the management network access is not possible?

Question31: The /store for a QRadar HA setup was migrated to a Fibre Channel device. High Availability is not needed on this cluster, and it needs to be disconnected.
What changes are required before disconnecting the HA cluster in this scenario?

Question32: This partial Network diagram was provided to a QRadar deployment professional who is trying to determine if the deployment requires the definition of multiple domains.
How many domains are required, and why?

Question33: How do you log in to a managed host command line after you install QRadar?

Question34: Where is a custom log source type created?

Question35: Which port is used by appliances that provide syslog events to send event data to QRadar components?

Question36: What is the hostcontext service?

Question37: How many default dashboards are available in Qradar?

Question38: What can content management scripts be used to accomplish?

Question39: How are Events that are associated with an offense listed?

Question40: The ____________ provides the current version, patch, and other system information for a QRadar system.

Question41: Under ATT&CK Actions, which option can be used to show an overview of the tactics covered in QRadar Use Case Manager?

Question42: What are unknown events?

Question43: A company plans to collect event data from two remote sites that have slow WAN links.
These remote sites do not generate many events per second. The company's deployment professional wants to deploy a system that can use EPS limiters to send events to the Event Processor to overcome WAN limitations.
What type of appliance can be used to meet this requirement?

Question44: Which parameter determines the impact of the offense on the network?

Question45: If you do not have access to the admin account from the user interface, how to change admin password?

Question46: Where is a QRadar license obtained?

Question47: To review the internal changes done in Qradar, what log source in log activity tab must be selected?

Question48: What is a difference between a flow and an event?

Question49: Which data is processed by the IBM Security QRadar Network Threat Analytics app?

Question50: An administrator needs to add, delete and modify user accounts.
When deleting a user, what dependency checks are carried out?

Question51: A QRadar deployment professional is asked to plan a hardware migration for an Event Processor in HA. Two new appliances are ready to be used, and they use the same IP addresses.
Which approach can be used to migrate the systems?

Question52: What must a deployment professional select when defining a new flow source?

Question53: Upon initial configuration, a company asks their deployment professional to move backups to an external device. They are concerned about the percentage of storage space that is used up on the volume, because QRadar no longer runs scheduled backups on this volume.
What percentage of the volume do they suspect is used?

Question54: Which of these procedures duplicates a report from the Reports tab?

Question55: On a Microsoft Windows 2019 server, a WinCollect agent is installed, which polls events locally. Its profile is set to Maximum EPS and the average EPS is 5000.
What is the minimum RAM requirement for this Windows 2019 server?

Question56: What are the types of reference data collections in QRadar?

Question57: Which are stored events?

Question58: There are 10 retention buckets in Qradar SIEM. The default is placed in the last line with retention policy of 30 days. Action is set to delete the data immediately after retention period has expired. Admin creates another policy on top of the default policy to keep firewall data for 10 days.
What will happen to the data after 30 days?

Question59: After a successful upgrade, which two actions does a deployment professional perform to complete the installation?

Question60: There are frequent network interruptions from a particular network zone called "Underground" to the network where QRadar components are installed. Some important applications, though not time critical, are running in the "Underground" network zone. The log data from these applications needs to be sent to QRadar Event Processor for compliance.
How can QRadar receive the logs from the applications in the "Underground" network zone?

Question61: When multiple repositories are configured for authentication, what must a user do when they log in?

Question62: What approach does QRadar take when it imposes EPS license (not hardware) limits on events that temporarily spike above that limit?

Question63: What is the minimum disk size for a QRadar virtual appliance installation?

Question64: Which of the following changes require standard deployment?

Question65: Which of these is a tenant administrator responsible for?

Question66: A QRadar deployment professional has been asked to merge two QRadar deployments (AIO_A and AIO_B) into one new environment (AIO_C). Each environment consists of an All-in-One appliance. There is no requirement to migrate the Ariel data.
What is the way to approach the migration?

Question67: Which of the following is used to process flows in Qradar?

Question68: Which version of sFlow does QRadar support when defining a new flow source?

Question69: What is the directory where a backup archive file needs to be placed so that QRadar can automatically import it?

Question70: Which two passwords does a deployment professional configure when installing QRadar? (Choose two.)

Question71: To increase the amount of storage for IBM Security QRadar, data is moved to an offboard storage device.
Which method for adding external storage must be used for /store/ariel?

Question72: Which command can be used to check the amount of available physical and swap memory?

Question73: Which are the time criteria in AQL queries?

Question74: If a security analyst needs to filter Events according to when they occurred, which parameter should be used?

Question75: QRadar uses rules to monitor the events and flows in your network to detect security threats. When the events and flows meet the test criteria that is defined in the rules, an offense is created to show that a security attack or policy breach is suspected. Knowing that an offense occurred is only the first step; identifying the root cause of the offense requires analysis.
These statements refer to what kind of Offense Management?

Question76: The Server Discovery function can update which system building block?

Question77: Which regex statement extracts the DNS host from the cs-host value from the payload?

Question78: A QRadar analyst was asked to provide a selection of events for further investigation by somebody who does not have access to the QRadar system.
Which of these approaches provides an accurate copy of the required data in a readable format?

Question79: Which of these statements is true about network objects?

Question80: An organization's QRadar deployment was reviewed. It was determined that more storage is needed.
Which appliance should be deployed to meet this need?

Question81: Where can one share, find available apps, discover what they are used for, discover what they look like, and learn what other users say about apps?

Question82: In a multitenant environment, what is prevented by assigning log sources to a specific domain?

Question83: The ____________command removes a directory and all files in it.

Question84: Which tool can be used to check the connections to all managed hosts and verify the versions of ECS and ECS-Ingress services after an upgrade?

Question85: Where are audit logs located?