IBM C1000-162 Quiz 1 Topic 1 Questions 1-5

Question: 1

In Rule Response, which two (2) options are available for Offense Naming?

AThis information should be removed from the current name of the associated offenses

BThis information should contribute to (he name of the associated offenses

CThis information should set or replace the name of the associated offenses

DThis information should contribute to the dispatched event name of the associated offenses.

EThis information should contribute to the category naming of the associated offenses

Show Answer

Question: 2

AQRadar analyst can check the rule coverage of MITRE ATT&CK tactics and techniques by using Use Case Manager.

In the Use Case Manager app, how can a QRadar analyst check the offenses triggered and mapped to MITRE ATT&CK framework?

ABy navigating to 'CRE Report'

BFrom Offenses tab

CBy clicking on 'Tuning Home'

DBy navigating to 'Detected in timeframe'

Show Answer

Question: 3

A QRadar analyst wants to limit the time period for which an AOL query is evaluated. Which functions and clauses could be used for this?

ASTART, BETWEEN. LAST. NOW. PARSEDATETIME

BSTART, STOP. LAST, NOW, PARSEDATETIME

CSTART. STOP. BETWEEN, FIRST

DSTART, STOP. BETWEEN, LAST

Show Answer

Question: 4

Events can be exported from the QRadar Log Activity tab in which file formats?

AJSON. XML, and CSV

BXLS and CSV

CJSON and XML

DXML and CSV

Show Answer

Question: 5

QRadar analysts can download different types of content extensions from the IBM X-Force Exchange portal. Which two (2) types of content extensions are supported by QRadar?

ACustom Functions

BEvents

CFlows

DFGroup

EOffenses

Show Answer

IBM C1000-162 Quiz:1 Topic:1 Questions:1-5