EMT Practice Test

1. Question Content...

Previous Submit Next
Was this helpful? Upvote!
Question List

Question1: During the IBM Security QRadar SIEM V7.2.8 installation, which two default user roles are defined?
(Choose two.)

Question2: Which permission can be assigned to a user from User Roles in the IBM Security QRadar SIEM V7.2.8 Console?

Question3: Offense data has become corrupted, what option should an IBM Security QRadar SIEM V7.2.8 Administrator consider to recover the offenses?

Question4: An Administrator of an IBM Security QRadar SIEM V7.2.8 deployment needs to exclude the mail servers from a custom rule.
How would the Administrator complete this task?

Question5: The event data collected by IBM Security QRadar SIEM V7.2.8 is being deleted after one month. The legal department required the data be kept for two months.
What can the administrator do to accommodate this requirement?

Question6: An Administrator is adding a log source in IBM Security QRadar SIEM V7.2.8.
What required software application that supports the log source should be used for this procedure?

Question7: An Administrator working within IBM Security QRadar SIEM V7.2.8 has created a network hierarchy that includes the following groups and subgroups:
Office #1 Group
- Miscellaneous 10.10.0.0/24
- Sales 10.10.8.0/24
- Marketing 10.10.1.0/24
Office #2 Group
- Miscellaneous 10.20.0.0/16
- Sales 10.20.8.0/24
- Marketing 10.20.1.0/24
A new subgroup is added to Office #1 having a CIDR of 10.10.50.0/24. Offenses are being triggered and during the investigation, it is noticed the rule should not fire if traffic is L2L. The offense is being triggered on traffic from 10.10.4.17 to 10.20.1.8.
Is this rule using the network hierarchy correctly?

Question8: Where are the logs for QFlow stored on IBM Security QRadar SIEM V7.2.8?

Question9: What is the difference between Flows and Event data collected by IBM Security QRadar SIEM V7.2.8?

Question10: The Administrator of an IBM Security QRadar SIEM V7.2.8 deployment needs to determine which rules are most active in generating offenses.
How would the Administrator accomplish this from the Offenses tab of the QRadar console?

Question11: An Administrator working with IBM Security QRadar SIEM V7.2.8 needs to enable the PCI report template.
What is the procedure to accomplish this task?

Question12: Where are system notifications located in IBM Security QRadar SIEM V7.2.8?

Question13: What procedure does a user of IBM Security QRadar SIEM V7.2.8 need to follow to delete a dashboard?

Question14: What are three protocols that collect flow data from network devices, such as routers, and send this data to IBM Security QRadar SIEM V7.2.8?

Question15: An Administrator using IBM Security QRadar SIEM V7.2.8 is using the RegEx syntax below:
(\b\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\b)
What type of information is it designed to extract?

Question16: An Administrator working with IBM Security QRadar SIEM V7.2.8 appliances needs to update firmware.
How are the files acquired?

Question17: An IBM Security QRadar SIEM V7.2.8 Administrator needs to retain authentication failure data to a specific domain, for a longer period than the rest of the event data being collected.
How is this task completed?

Question18: Which AQL query, when run from IBM Security QRadar SIEM V7.2.8, will show EPS broken down by domains?

Question19: An IBM Security QRadar SIEM V7.2.8 Administrator wants to create a security profile within the system but receives an error upon saving.
What is a possible reason for this error?

Question20: What is needed to send the same events and flows to separate data centers or geographically separate sites and enable data redundancy in IBM Security QRadar SIEM V7.2.8?

Question21: An Administrator working within IBM Security QRadar SIEM V7.2.8 has a network hierarchy that cannot support anymore network objects. To remedy this, they want to implement a supernet. Some of the customer CIDRs are:
- 209.60.128.0/24
- 209.60.129.0/24
- 209.60.130.0/24
- 209.60.131.0/24
Which supernet should be used to shrink the amount of network objects for the supplied group of CIDRs?

Question22: An Administrator using IBM Security QRadar SIEM V7.2.8 is using the following RegEx:
([-+]?\d*$)
What type of information is it designed to extract?

Question23: An Administrator is tasked with installing additional log resources into an IBM Security QRadar SIEM V7.2.8 deployment, bringing the total number of log source to 900. The deployment is using the default license and the Administrator is getting an error attempting to add these additional log sources.
Why is this error happening?

Question24: An Administrator working with IBM Security QRadar SIEM V7.2.8 needs to copy data and configuration backup files from the previous day to an off-site location.
What is the default location where these files can be found?

Question25: An Administrators will add a secondary host to an IBM Security QRadar SIEM V7.2.8 Console in a High Availability (HA) deployment scenario.
After checking the compatibility between primary and secondary HA pairs, what other prerequisite should the Administrator check within Managed Interfaces?

Question26: An IBM Security QRadar SIEM V7.2.8 Administrator needs to download a nightly configuration backup file from a past day through the Web Console.
Which steps must be followed to achieve this?

Question27: An Administrator working with IBM Security QRadar SIEM V7.2.8 needs to delete a single value named User1 from a reference set with the name "Allowed Users" from the command line interface.
Which command will accomplish this?

Question28: An IBM Security QRadar SIEM V7.2.8 Administrator needs to check if the "hostcontext" process is running.
How can the Administrator do this?

Question29: An Administrator working with a customer looking to add IBM Security QRadar SIEM V7.2.8 into their network, has some requirements. The customer is looking to have 40Tb of raw storage space for events and console data.
What appliances allow for this requirement to be met?

Question30: Which is an officially supported operating system for IBM Security QRadar SIEM V7.2.8 installations on customer supplied hardware?

Question31: After downloading the <QRadar_patchupdate>.sfs file from Fix Central, what is the next step to upgrade IBM Security QRadar SIEM V7.2.8?

Question32: What data is purged by the SIM reset process "Hard Clean" in IBM Security QRadar SIEM V7.2.8?

Question33: An IBM Security QRadar SIEM V7.2.8 Administrator will install a High Availability (HA) pair of appliances.
The primary and secondary hosts are formatted with the same file system.
To ensure compatibility between hosts, which statement is considered a prerequisite?

Question34: When it comes to licensing, what is the difference between Events and Flows and how they are licensed?

Question35: What is the maximum number of dashboards a user can create with IBM Security QRadar SIEM V7.2.8?

Question36: An IBM Security QRadar SIEM V7.2.8 Administrator assigned to a company that is looking to add QRadar into their current network. The company has requirements for 250,000 FPM, 15,000 EPS and FIPS.
Which QRadar appliance solution will support this requirement?

Question37: Administrators on versions of IBM Security QRadar SIEM older than V7.2.4 must use a specific upgrade path to transition to newer software versions. These requirements are outlined in what technical document?

Question38: An Administrator working with IBM Security QRadar SIEM V7.2.8 is constantly receiving the following message:
"SAR Sentinal: Threshold crossed."
Where will the Administrator tune the settings for these messages?

Question39: A retention policy allows an IBM Security QRadar SIEM V7.2.8 Administrator to define how long the system is required to keep certain types of data and what to do when data reaches a certain age. If a 3- month retention policy is defined for all events, then the system will not delete event data until it's on disk timestamp is 3 months in the past.
Which two choices are available in the 'delete data in this bucket'? (Choose two.)

Question40: An IBM Security QRadar SIEM V7.2.8 Administrator is receiving an I/O error on the console.
Which command can the Administrator run to begin diagnosing this issue?

Question41: An Administrator working with IBM Security QRadar SIEM V7.2.8 only needs to remove a single host (10.1.95.142) from the reference set with the name "Asset Reconciliation IPv4 Whitelist" from the command line interface.
Which command would accomplish this task?

Question42: An Administrator working with an IBM Security QRadar SIEM V7.2.8 deployment needs to build an Ariel Query to find all flow data send in the last 24 hours where the amount of bytes being sent and received are larger than 64 bytes.
What Query needs to be used?

Question43: An Administrator has configured a customized log source extension to provide asset updates to IBM Security QRadar SIEM V7.2.8. Instead of QRadar receiving an update that has the host name of the asset that the user logged in to, the log source generates many asset updates that all have the same host name.
In this situation what will QRadar report?

Question44: Which appliance of the IBM Security QRadar SIEM V7.2.8 family is a specifically used to gather events from local and remote log sources?

Question45: An Administrator working with IBM Security QRadar SIEM V7.2.8 has updated the date/time on the QRadar console system and wants to update these date/time settings to all his hosts in the distributed environment.
What command should be run?

Question46: An Administrator needs to see Events per Second (EPS) and Flows per Minute (FPM) coming to IBM Security QRadar SIEM V7.2.8 through a dashboard. How could this be accomplished?

Question47: The event pipeline for processing event data before viewing and using event data on the IBM Security QRadar SIEM V7.2.8 console consists of many components, what is one component?

Question48: When an IBM Security QRadar SIEM V7.2.8 distributed deployment requires scaling horizontally to achieve Event per Second (EPS) requirements, what QRadar Component needs to be added to meet the EPS demands?

Question49: An Administrator working with IBM Security QRadar SIEM V7.2.8 was tasked with adding a new Microsoft Azure log source.
What protocol is supported for this?

Question50: An IBM Security QRadar SIEM V7.2.8 Administrator notices a specific MAC address added to the Asset Reconciliation Domain MAC was blacklisted.
What scenario is causing this to occur?

Question51: What is the Events Per Second (EPS) basic license limit in an IBM Security QRadar V7.2.8 2100 hardware appliance?

Question52: An Administrator working with IBM Security QRadar SIEM V7.2.8 needs to assign a report to a group named Network Management.
What is the process for this task to be completed?

Question53: An Administrator using IBM Security QRadar SIEM V7.2.8 needs to force an instant backup to run.
Which option should be selected?

Question54: An Administrator needs to create a new user role in the IBM Security QRadar SIEM V7.2.8 system.
What steps need to be followed?

Question55: How can an IBM Security QRadar SIEM V7.2.8 Administrator capture specific data to a reference set when QRadar receives the data from events or flow data?

Question56: Where are the IBM Security QRadar SIEM V7.2.8 log files located?