Free IBM C1000-156 Exam Dumps Questions & Answers

Which authentication type in QRadar encrypts the username and password and forwards the username and password to the external server for authentication?

• A.  RADIUS authentication
• B.  Two-factor authentication
• C.  System authentication
• D.  TACACS authentication

When will events or flows stop contributing to an offense?

• A.  When you protect the offense
• B.  When the offense becomes inactive
• C.  After the offense is assigned to an analyst
• D.  When the offense becomes dormant

Which is a valid routing rule combination?

• A.  Drop and Log Only
• B.  Bypass Correlation and Log Only
• C.  Forward and Bypass Correlation
• D.  Drop and Bypass Correlation

Which event advanced search query will check an IP address against the Spam X-Force category with a confidence greater than 3?

• A.  select * from flows where XF0RCE_iP_C0NFiDEKCE{*Malware',sourceip)-3
• B.  select * from events where XFORCE_IP_CONFIDENCE( 'Spam', sourceip>>3
• C.  select * from events where XF0RCE_IP_C0NFIDENCE('Malware',sourceip)>3
• D.  select * from flows where XFORCE_IP_CONFIDENCE{'Spam', sourceip)<3

Which three (3) resource restriction types are available in QRadar?

• A.  Event-based restrictions
• B.  Tenant-based restrictions
• C.  Role-based restrictions
• D.  Domain-based restrictions
• E.  User-based restrictions
• F.  Service-based restrictions