EMT Practice Test

1. Question Content...

---

Question1: A Deployment Professional is performing a new deployment, and the customer wants to monitor network traffic by sending raw data packets from a network device to IBM Security QRadar SEAM V7.2.7.
Which method should be used?

Question2: How can a Deployment Professional fix rules that are not distinguishing between remote and local hosts?

Question3: A Deployment Professional is working with a customer running an IBM Security QRadar SIEM V7.2.7 installation that is currently running into performance issues. The customer is noticing that searches are taking a long time to finish and there are performance degradation system notifications in the Console.
Which two steps will lead to a performance increase for this customer? (Choose two.)

Question4: A Deployment Professional needs to store information in the IBM Security QRadar SIEM V7.2.7 asset database which is provided from the customer's configuration management data base (CMDB). The CMDB provides a nightly dump of information like 'Technical Owner' and "Asset weight' tied to an IP address.
Which integration mechanism with QRadar will allow this information to be maintained?

Question5: A client has configured a log source to forward events to IBM Security QRadar SIEM V7.2.7. It is recommended that the log source level be configured at the notice level by the DSM Guide, but the client has a policy to log all events at a debug level.
The Deployment Professional notices that the configured DSM is parsing most events, but some are being labeled as stored. The client is very interested in correlating some of the events that are being stored.
What should be created to meet this client's goal?

Question6: A Deployment Professional was asked to investigate the following error:
Custom Rule Engine has detected a total of 20487 dropped event(s). 20487 event(s) were dropped in the last 62 seconds. Queue is at 99 percent capacity
The Deployment Professional needs to run the command
"/opt/qradar/bin/findExpensiveCustomRules.sh" to gather the necessary troubleshooting logs.
When should this command be run?

Question7: Two health insurance companies, Company A and Company B, have been involved in a merger. Both companies have IBM Security QRadar SIEM V7.2.7 implemented to monitor their environments.
It has been determined that Company A will assume the duties of compliance monitoring across the entire organization. Because of this, Company B will need to forward its events encrypted to Company A's QRAdar Event Collector.
What is one of the steps that must be done to make sure the information is encrypted in transit?

Question8: A customer has a following data:

The customer wants the Deployment Professional to store this information in Reference Data in QRadar in order to:
Display the system's 'zone' in an AQL search result.

Test for the system's 'owner' in a rule test

Which type of Reference Data can fulfill both tasks?

Question9: A current banking customer has just expanded by purchasing a small rural bank with a low bandwidth WAN connection.
The customer wants to expand its current QRadar SIEM 3105 all-in-one deployment to capture log events from the newly acquired branch and to forward them on a schedule, after hours during the trough of activity to the main branch. There is plenty of room for this additional EPS growth.
Which device will meet the requirements?

Question10: A Deployment Professional is working with a new customer that wishes to deploy IBM Security QRadar SIEM V7.2.7 using a cloud solution.
Which two providers are officially supported for this functionality? (Choose two).

Question11: A custom with IBM Security QRadar SIEM V7.2.7 is using Active Directory to authenticate users. After a crash, the authentication servers are down and some users tried to log in before the authentication servers came back up.
What will happen to these users?

Question12: A Deployment Professional needs to change the folder where automatic updates are downloaded.
Which Auto Update settings should be configured under Change Settings?

Question13: A Deployment Professional has detected a big spike in a customer's "Malware infection detected" rule that monitors their endpoint anti-virus solution. The spike happened over the weekend, but when the rule was checked, it was not changed. Since Monday morning, the rule has spiked and has not yet stopped generating offenses.
What was added to the customer's QRadar log sources that caused this problem?

Question14: A customer has existing complex network infrastructure with many redundant links and the IP packets are taking different paths for inbound and outbound traffic. A Deployment Professional needs to configure SFlow.
What should be configured in IBM Security QRadar SIEM V7.2.7 to support this specific case?

Question15: What is the procedure to configure basic system settings on an IBM Security QRadar V7.2.7 system once the System Configuration panel is accessed under the Admin Tab?

Question16: A Deployment Professional has a reference list of usernames that is used in rules. The Deployment Professional needs to be able to remove a username from the reference list when an offense is detected from a log event.
How can a Deployment Professional accomplish this goal?

Question17: A client has reached the maximum of 5000 EPS for their 3128 All-in-One appliance. They have just completed an acquisition of a competitor company and would like to get them on-board with collecting events for correlation in QRadar. It has been determined that the newly acquired company has a large number of log sources, and it is estimated that its total EPS will be approx. 22000 EPS.
What will meet the hardware requirements when changing to a distributed environment?

Question18: During a new IBM Security QRadar V7.2.7 deployment, a Deployment Professional is performing a deployment in a client environment where there is no tab or SPAN to take advantage of QRadar's Internal Flow sources.
What could be a valid External flow source for collecting flows?

Question19: Which QRadar module collects configurations of network devices?

Question20: A Deployment Professional using IBM Security QRadar SIEM V7.2.7 needs to discover all mail servers, but some of the mail servers are listening on TCP port 10025.
Which server type and port could be configured in server discovery to accomplish this goal?

Question21: Which task can be completed by using the Historical Correlation feature?

Question22: A Deployment Professional is asked to determine what could be done to decrease latency of events received by an IBM Security QRadar V7.2.7 Console based in the United States, which is receiving logs sent directly from a data center in China.
Which appliance could be installed in the Chinese data center to accomplish this goal?

Question23: Which two permissions are required to modify custom properties? (Choose two.)

Question24: Which IBM Security QRadar function, if misconfigured, could cause rules that are only supposed to be applied to local hosts to be applied to external hosts?

Question25: A software install is being performed on a client's hardware. The Deployment Professional is about to install the QRadar software on a host which will become an HA primary.
Which command is mandatory?

Question26: What is the impact on network bandwidth when selecting 'Global' on a rule instead of 'Local' in a distributed environment?

Question27: A Deployment Professional needs to handle event logs from Point-of-Sale (POS) devices on cruise ships which have sporadic connectivity to the rest of the deployment.
Which appliance can be used to store and forward these events?

Question28: A Deployment Professional has created a new Building Block (BB), and it's not returning any expected events. The Deployment Professional has checked to ensure the BB is enabled and active. No errors are returned.
What should be done to correct this BB problem?

Question29: What are the minimum bandwidth and latency parameters required for a high availability IBM Security QRadar SIEM V7.2.7 cluster to assure consistency of data if a company has disaster recovery in another city?

Question30: Two multi-site companies with international presences are merging and consolidating their operations. The companies have decided that the relevant information on each site must be available to the local users only.
How should IBM Security QRadar SIEM V7.2.7 be configured to comply with this request?

Question31: A Deployment Processional is performing a new deployment and needs to collect flows through NetFlow version 5, Netflow version 9, IPFIX and Sflow. The network is complex and heterogeneous.
What is the minimum number of flow sources that are needed for this IBM Security QRadar SIEM 7.2.7 deployment?

Question32: You are tasked with configuring IBM Security QRadar SIEM V7.2.7 to pull a log file that generated daily at midnight from a custom application on a Microsoft© Windows Server.
Which log source protocol should be used to accomplish this task?

Question33: In IBM Security QRadar SIEM V7.2.7, the number of Aggregated Data Management Views were increased.
How many additional views were added?

Question34: A Deployment Professional is reviewing a custom rule that is supposed to be catching internal users that might be leaking information. The customer has requested that events that are being used for this rule have the email address of the sender.
This information is in the payload in the format "email from: [email protected] subject:" Which regular expression should be used to create a custom property to fulfill this request?

Question35: A Deployment Professional is alerted that flows between two assets within a local network are communicating at a higher rate than normal between midnight and 2 a.m. The Deployment Professional is asked to determine why this is occurring and decides to create an alert that will send a notification when the communication happens again.
Which action could be used?

Question36: A Deployment Professional is looking over event and flow data for a new customer and sees that the customer is hitting 4,000 EPS/300,000 FPM, with bursts of up to 5,000 EPS/400,000 FPM. The customer is asking for the least amount of appliances to be installed to handle this traffic without any throttling.
Which combination should be installed?

Question37: Which set of rules should be adhered to in order to create valid expression for creating custom properties?

Question38: A Deployment Professional wants to reduce the number of false positives being generated by a WebSense log source.
Which rule test could be created to solve this problem, assuming the Building Blocks have been updated for the customer's environment?

Question39: A Deployment Professional is asked to create a redundancy link with fail over for backup.
Which mode should be used if only a redundancy link is requested?

Question40: A Deployment Professional has come on-site to upgrade a IBM Security QRadar SIEM V7.2.7 deployment to a new fix level. Before running the upgrade, the software and fix versions must be verified.
What must the Deployment Professional verify?

Question41: A Deployment Professional is asked to check on an anomaly that is based off of aggregated data collected for the rule "Spike in Data Outbound". When looking at the Top 10 Events of an offense and clicking on the display icon for "Source Network is Users.Users_1", the available data shows in a chart. The Deployment Professional would like to examine the variation in the data in a linear manner.
Which chart type should be used?

Question42: A Deployment Professional needs to improve bandwidth when bonding two or more interfaces together.
Which bonding mode option should be used?

Question43: A Deployment Professional has been asked to create a new dashboard which consists of utilizing a saved search.
Which box should be checked when creating this search?

Question44: A Deployment Professional is working with IBM Security QRadar SIEM V7.2.7. for a new customer that is trying to create their network hierarchy. The customer currently has more than the maximum of 1,000 network objects and CIDR ranges. A few of the CIDRs of the customer are:
209.60.128.0/24

209.60.129.0/24

209.60.130.0/24

209.60.131.0/24

Which supernet should be used to shrink the amount of network objects for the supplied group of CIDRs?

Question45: A Deployment Professional needs to create and share a saved search with other users.
What are the requirements for this action?

Question46: A System Notification on a QRadar Console states "An allocated license has expired and is no longer valid". After an investigation, the Deployment Professional notices that the X-Force feed license has expired.
How will this expiration affect the system?

Question47: A Deployment Professional is investigating an offense and decides that a custom property should be added to the event and the rule to make them more useful. Once is added, though, the rule stops firing.
What could be causing this problem?

Question48: Which port must be open for Distributed Replicated Block Device (DRBD) traffic between primary and secondary HA-host?

Question49: A customer expanded operations by merging with an acquisition, adding additional traffic. Overall concerns have surfaced about event collecting, and the Deployment Professional is asked about deployment costs, security, and resiliency due to the additional network segments. The focus is on keeping the overall SIEM collecting events as the priority.
Which deployment architecture collection method will meet this need?

Question50: A Deployment Professional is asked to schedule the forwarding of events when the network is quiet, usually around 2 to 3 a.m. console time. The customer states that there is no restriction to bandwidth on the available 1 Gbp/s WAM connection during this time.
Which value should be used for the forward transfer rate?

Question51: After creating a custom Log Source Extension to parse a Source IP address from this event snippet 'IP Address: (10.20.30.40), the Source IP is not being extracted from the payload.
The Log Source Extension is showing the following:
IP\sAddress:\s\((\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})
Which Regular Expression should be used to ensure the Source IP is parsed properly?

Question52: A Deployment Professional working with IBM SecurityQRadar SIEM V7.2.7 is configuring scanners for dynamic scanning and is working with a customer to explain how dynamic scanning works, presenting the following example.
Asset IP: 10.2.2.3
Scanner A CIDR: 10.2.2.0/24
Scanner B CIDR: 10.2.2.3/32
How is this asset scanned when utilizing dynamic scanning?

Question53: A Deployment Professional is investigating why a rule has stopped triggering. The rule is configured to monitor certain events from a specific syslog based Log Source. Upon investigation, the Deployment Professional observes that no events are being received by that Log Source in the Log Activity Tab.
The customer has recently reconfigured the sending system but demonstrates that events are still being sent to the QRadar Event Processor. After running a tcpdump on the Event Processor, events are indeed observed coming from the IP address of the sending system.
How can the Deployment Professional find an event in the QRadar GUI to discover which Log Source the events are being processed?

Question54: A custom wants to create a tickets in an external ticketing system when a Rule is triggered, the intention is to use a Custom Action Script to call REST-API of the ticketing system.
How could this be done in IBM Security QRadar SIEM V7.2.7?

Question55: A Deployment Professional has received complaints from a customer stating that events from a satellite Location in Hong Kong are being delayed, which is affecting records processing. The Deployment Professional wants to improve event transfer from that location to the IBM Security QRadar SIEM V7.2.7 Which appliance could be installed in the satellite location to accomplish this goal?

Question56: A Deployment Professional is working on configuring a deployment of IBM Security QRadar SIEM V7.2.7 and needs to determine how to configure FP, EP, FC, and EC. The customer has multiple different domains.
How can these managed devices be used, segmented and assigned to various domains?