An analyst for a particular offense needs to investigate to understand the breakdown of the offense details.
How can the analyst do this?

• A.Look at the magnitude information and its breakdown.
• B.View the attack path of the offense.
• C.Look at all the event QIDs attached to the offense.
• D.Look at the list of categories, event low level categories and the events attached.

Correct Answer: A

Comment: *

Name: *

Email: *

Verification: *

How can an analyst verify if any host in the deployment is vulnerable to CVE ID; CVE-2010-000?

• A.Use the asset search feature, select vulnerability external reference from the list of search parameters, select CVE and then type: $CVE-2010000
• B.Use the asset search feature, select vulnerability external reference from the list of search parameters, select CVE and then type: 2010-000
• C.Use the asset search feature, select vulnerability external reference from the list of search parameters, select CVE and then type: CVE-2010000
• D.Use the asset search feature, select vulnerability external reference from the list of search parameters, select CVE and then type: $2010-000

Comment: *

Name: *

Email: *

Verification: *

An analyst is investigating access to sensitive data on a Linux system. Data is accessible from the /secret directory and can be viewed using the 'sudo oaf command. The specific file /secret/file_08-txt was known to be accessed in this way. After searching in the Log Activity Tab, the following results are shown.

When interpreting this, the analyst is having trouble locating events which show when the file was accessed.
Why could this be?

• A.The 'LinuxServer @ cantos' log source has boon configured as a Faise Positive and the specific event for that file has been dropped.
• B.The 'LinuxServer @ centos' log source has not been configured to send the relevant events to QRadar.
• C.The 'LinuxServer @ centos' log source has coalescing configured and the specific event for that file can only be accessed by clicking on the 'Event Count' value.
• D.The ;LinuxServer @ centos; log source has coalesscing conigured and the specific event for that file has been discardedd.

Comment: *

Name: *

Email: *

Verification: *

What information is displayed in the default "Log Activity" page? (Choose two.)

• A.QID
• B.Protocol
• C.Qmap
• D.Log Source
• E.Event Name

Correct Answer: D,E

Explanation
By default, the Log Activity tab displays the following parameters when you view normalized events:

Comment: *

Name: *

Email: *

Verification: *

When ordering these tests in an event rule, which of them is the best test to place at the top of the list for rule performance?

• A.When the event(s) were detected by one or more of [these log sources]
• B.When the source is [local or remote]
• C.When an event matches all of the following [Rules or Building Blocks]
• D.When the destination is [local or remote]

Comment: *

Name: *

Email: *

Verification: *