Which log should be reviewed to determine the reasons a patch installer did not proceed during a QRadar upgrade?

• A./var/log/qradar.audit
• B./var/log/qradar.log
• C./var/log/setup-*/patches.log
• D./var/log/upgrade.log

Comment: *

Name: *

Email: *

Verification: *

An administrator is about to integrate logs from a custom firewall in a QRadar deployment using syslog. The SIEM has two domains, namely Domain A and Domain
B. While reviewing the following sample logs, the administrator notices a "context" keyword:
May 14 11:05:01 192.168.1.23 20190514 11:05:00 context=contextA permit 192.168.1.24 source: 10.10.1.15; source_port: 64094; destination: 10.10.13.34; service: 53; protocol: udp; May 13 12:07:01 192.168.1.23 20190513 11:07:00 context=contextB permit 192.168.1.25 source: 10.10.1.15; source_port: 64094; destination: 10.10.13.34; service: 53; protocol: udp; Which options assign the "contextA" logs to DomainA and the "contextB" logs to domain B? (Choose two.)

• A.Create a single log source, create a "Context" custom event property, and assign the log to the correct domain using custom event property value.
• B.Create two individual log sources by configuring a separated logging instance for each context on the firewall and assign each log source to the correct domain.
• C.Create a single log source, create a "Context" custom event property, and assign the log to both domains using a custom rule.
• D.Create two individual log sources using the context value as log source identifier and assign each log source to the correct domain.
• E.Create a single log source, create a "Context" custom event property, and assign the log to the correct domain using a custom rule.

Comment: *

Name: *

Email: *

Verification: *

An administrator is about to integrate logs from a custom firewall in a QRadar deployment using syslog. The SIEM has two domains, namely Domain A and Domain B.
While reviewing the following sample logs, the administrator notices a "context" keyword:
May 14 11:05:01 192.168.1.23 20190514 11:05:00 context=contextA permit 192.168.1.24 source:
10.10.1.15; source_port: 64094; destination: 10.10.13.34; service: 53; protocol: udp; May 13 12:07:01 192.168.1.23 20190513 11:07:00 context=contextB permit 192.168.1.25 source:
10.10.1.15; source_port: 64094; destination: 10.10.13.34; service: 53; protocol: udp; Which options assign the "contextA" logs to DomainA and the "contextB" logs to domain B? (Choose two.)

• A.Create a single log source, create a "Context" custom event property, and assign the log to the correct domain using custom event property value.
• B.Create two individual log sources by configuring a separated logging instance for each context on the firewall and assign each log source to the correct domain.
• C.Create two individual log sources using the context value as log source identifier and assign each log source to the correct domain.
• D.Create a single log source, create a "Context" custom event property, and assign the log to both domains using a custom rule.
• E.Create a single log source, create a "Context" custom event property, and assign the log to the correct domain using a custom rule.

Comment: *

Name: *

Email: *

Verification: *

An administrator needs to save a search to use it in the dashboards.
To do so, which search feature does the administrator need to select in the "Include in my Dashboard" checkbox?

• A.Filter events of the last 7 days
• B.Filter events of the last month
• C.Filter events of the last 5 minutes
• D.Group by some property

Comment: *

Name: *

Email: *

Verification: *

A QRadar administrator added High Availability (HA) to the Event Processor and needs to verify the crossover link status between the primary and secondary hosts.
Which commands can be used to verify the crossover status? (Choose two.)

• A./opt/qradar/ha/bin/ha_getstate.sh
• B./opt/qradar/ha/bin/getStatus crossover
• C./opt/qradar/ha/bin/qradar_nettune.pl crossover status
• D./opt/qradar/ha/bin/qradar_nettune.pl linkaggr <interface> status
• E./opt/qradar/ha/bin/ha cstate
• F.cat /proc/drbd

Comment: *

Name: *

Email: *

Verification: *