EMT Practice Test

1. Question Content...

---

Question1: A Deployment Professional is performing a new deployment, and the customer wants to monitor network traffic by sending raw data packets from a network device to IBM Security QRadar SEAM V7.2.7.
Which method should be used?

Question2: A Deployment Professional has received complaints from a customer stating that events from a satellite Location in Hong Kong are being delayed, which is affecting records processing. The Deployment Professional wants to improve event transfer from that location to the IBM Security QRadar SIEM V7.2.7 Console in Mexico.
Which appliance could be installed in the satellite location to accomplish this goal?

Question3: A customer has a following data:

The customer wants the Deployment Professional to store this information in Reference Data in QRadar in order to:
Display the system's 'zone' in an AQL search result.

Test for the system's 'owner' in a rule test

Which type of Reference Data can fulfill both tasks?

Question4: Two health insurance companies, Company A and Company B, have been involved in a merger. Both companies have IBM Security QRadar SIEM V7.2.7 implemented to monitor their environments.
It has been determined that Company A will assume the duties of compliance monitoring across the entire organization. Because of this, Company B will need to forward its events encrypted to Company A's QRAdar Event Collector.
What is one of the steps that must be done to make sure the information is encrypted in transit?

Question5: A Deployment Professional needs to change the folder where automatic updates are downloaded.
Which Auto Update settings should be configured under Change Settings?

Question6: A Deployment Professional wants to reduce the number of false positives being generated by a WebSense log source.
Which rule test could be created to solve this problem, assuming the Building Blocks have been updated for the customer's environment?

Question7: A software install is being performed on a client's hardware. The Deployment Professional is about to install the QRadar software on a host which will become an HA primary.
Which command is mandatory?

Question8: During a new IBM Security QRadar V7.2.7 deployment, a Deployment Professional is performing a deployment in a client environment where there is no tab or SPAN to take advantage of QRadar's Internal Flow sources.
What could be a valid External flow source for collecting flows?

Question9: Which set of rules should be adhered to in order to create valid expression for creating custom properties?

Question10: Which two permissions are required to modify custom properties? (Choose two.)

Question11: A Deployment Professional needs to improve bandwidth when bonding two or more interfaces together.
Which bonding mode option should be used?

Question12: A custom wants to create a tickets in an external ticketing system when a Rule is triggered, the intention is to use a Custom Action Script to call REST-API of the ticketing system.
How could this be done in IBM Security QRadar SIEM V7.2.7?

Question13: A Deployment Professional is working with a customer interested in deploying IBM Security QRadar SIEM V7.2.7 and is wishing to use the default configuration and default license with 1,600 network objects.
Why won't this work?

Question14: A System Notification on a QRadar Console states "An allocated license has expired and is no longer valid". After an investigation, the Deployment Professional notices that the X-Force feed license has expired.
How will this expiration affect the system?

Question15: A Deployment Professional was asked to investigate the following error:
Custom Rule Engine has detected a total of 20487 dropped event(s). 20487 event(s) were dropped in the last 62 seconds. Queue is at 99 percent capacity
The Deployment Professional needs to run the command
"/opt/qradar/bin/findExpensiveCustomRules.sh" to gather the necessary troubleshooting logs.
When should this command be run?

Question16: A Deployment Professional needs to create and share a saved search with other users.
What are the requirements for this action?

Question17: Which port must be open for Distributed Replicated Block Device (DRBD) traffic between primary and secondary HA-host?

Question18: Which QRadar module collects configurations of network devices?

Question19: A Deployment Processional is performing a new deployment and needs to collect flows through NetFlow version 5, Netflow version 9, IPFIX and Sflow. The network is complex and heterogeneous.
What is the minimum number of flow sources that are needed for this IBM Security QRadar SIEM 7.2.7 deployment?

Question20: Which task can be completed by using the Historical Correlation feature?

Question21: After creating a custom Log Source Extension to parse a Source IP address from this event snippet 'IP Address: (10.20.30.40), the Source IP is not being extracted from the payload.
The Log Source Extension is showing the following:
IP\sAddress:\s\((\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3})
Which Regular Expression should be used to ensure the Source IP is parsed properly?

Question22: A custom with IBM Security QRadar SIEM V7.2.7 is using Active Directory to authenticate users. After a crash, the authentication servers are down and some users tried to log in before the authentication servers came back up.
What will happen to these users?

Question23: A Deployment Professional needs to store information in the IBM Security QRadar SIEM V7.2.7 asset database which is provided from the customer's configuration management data base (CMDB). The CMDB provides a nightly dump of information like 'Technical Owner' and "Asset weight' tied to an IP address.
Which integration mechanism with QRadar will allow this information to be maintained?

Question24: A Deployment Professional is asked to determine what could be done to decrease latency of events received by an IBM Security QRadar V7.2.7 Console based in the United States, which is receiving logs sent directly from a data center in China.
Which appliance could be installed in the Chinese data center to accomplish this goal?

Question25: A Deployment Professional needs to handle event logs from Point-of-Sale (POS) devices on cruise ships which have sporadic connectivity to the rest of the deployment.
Which appliance can be used to store and forward these events?

Question26: A Deployment Professional is looking over event and flow data for a new customer and sees that the customer is hitting 4,000 EPS/300,000 FPM, with bursts of up to 5,000 EPS/400,000 FPM. The customer is asking for the least amount of appliances to be installed to handle this traffic without any throttling.
Which combination should be installed?

Question27: A Deployment Professional is reviewing a custom rule that is supposed to be catching internal users that might be leaking information. The customer has requested that events that are being used for this rule have the email address of the sender.
This information is in the payload in the format "email from: [email protected] subject:" Which regular expression should be used to create a custom property to fulfill this request?

Question28: A current banking customer has just expanded by purchasing a small rural bank with a low bandwidth WAN connection.
The customer wants to expand its current QRadar SIEM 3105 all-in-one deployment to capture log events from the newly acquired branch and to forward them on a schedule, after hours during the trough of activity to the main branch. There is plenty of room for this additional EPS growth.
Which device will meet the requirements?

Question29: A Deployment Professional is working with a customer running an IBM Security QRadar SIEM V7.2.7 installation that is currently running into performance issues. The customer is noticing that searches are taking a long time to finish and there are performance degradation system notifications in the Console.
Which two steps will lead to a performance increase for this customer? (Choose two.)

Question30: What is the impact on network bandwidth when selecting 'Global' on a rule instead of 'Local' in a distributed environment?

Question31: A Deployment Professional is asked to check on an anomaly that is based off of aggregated data collected for the rule "Spike in Data Outbound". When looking at the Top 10 Events of an offense and clicking on the display icon for "Source Network is Users.Users_1", the available data shows in a chart. The Deployment Professional would like to examine the variation in the data in a linear manner.
Which chart type should be used?

Question32: Which CLI command should be used to change the default password from PASSWORD to S3cure for the username USERID?

Question33: A customer expanded operations by merging with an acquisition, adding additional traffic. Overall concerns have surfaced about event collecting, and the Deployment Professional is asked about deployment costs, security, and resiliency due to the additional network segments. The focus is on keeping the overall SIEM collecting events as the priority.
Which deployment architecture collection method will meet this need?

Question34: Which IBM Security QRadar function, if misconfigured, could cause rules that are only supposed to be applied to local hosts to be applied to external hosts?