Free IBM C1000-162 Exam Dumps Questions & Answers

Which two (2) statements regarding indexed custom event properties are true?

• A.  The indexed filter eliminates portions of the data set and reduces the overall data volume and number of event or flow logs that must be searched.
• B.  Use indexed event and flow properties to optimize your searches.
• C.  By default, data retention for the index payload is 7 days.
• D.  The indexed filter adds to portions of the data set.
• E.  Indexing searches a full event payload for values.

Which two (2) tasks are uses of the QRadar network hierarchy?

• A.  Monitor traffic and profile the behavior of each group and host within the group
• B.  Monitor risky users within your organization
• C.  Monitor network devices
• D.  Determine and identify Command and Control systems
• E.  Understand network traffic

What are two (2) Y-axis types that are available in the scatter chart type in the Pulse app?

• A.  General
• B.  Linear
• C.  Log
• D.  Threshold
• E.  Dynamic

How can adding indexed properties to QRadar improve the efficiency of searches?

• A.  By slowing down the search process
• B.  By increasing the size of the data set required to find non-indexed search values
• C.  By reducing the size of the data set required to find non-indexed search values
• D.  By reducing the number of indexed search values

A mapping of a username to a user's manager can be stored in a Reference Table and output in a search or a report.
Which mechanism could be used to do this?

• A.  Reference Table lookup values can be accessed in an advanced search.
• B.  Reference Table lookup values are automatically used whenever a saved search is run.
• C.  Quick Search filters can select users based on their manager's name.
• D.  Reference Table lookup values can be accessed as custom event properties.