C1000-026: IBM Security QRadar SIEM V7.3.2 Fundamental Administration

An administrator needs to import data into QRadar for a specific use case.

The data that has been provided to the administrator is stored in records that map a key to a value.

Which type of data collection must the administrator create?

Reference set
Reference map of sets
Reference map
Reference map of maps

Correct answer: B

Explanation:

Reference: https://www.ibm.com/support/knowledgecenter/en/SS42VS_7.3.2/com.ibm.qradar.doc/t_qradar_conifig_rul_resp_reference_set.html

An administrator needs to know if a custom rule is being correlated correctly.

Which QRadar component is responsible for this process?

QRadar Event Collector
QRadar Console
Magistrate
QRadar Event Processor

Correct answer: D

Explanation:

Reference: https://www.ibm.com/support/pages/qradar-global-correlation

An administrator needs to collect logs from the Command Line Interface (CLI).

Which command should the administrator use?

/opt/bin/qradar/support/get_logs.sh
/opt/support/get_logs.sh
/opt/support/qradar/get_logs.sh
/opt/qradar/support/get_logs.sh

Correct answer: D

Explanation:

Reference: https://www.ibm.com/support/pages/getting-help-what-information-should-be-submitted-qradar-service-request

To comply with specific regulations, an administrator has been requested to increase asset retention to 365 days.

In which QRadar section can the administrator find the asset retention settings?

Admin Tab / Asset Retention
Assets Tab / Retention settings
Admin Tab / System settings
Assets Tab / Asset Retention

Correct answer: C

Explanation:

Reference: https://www.ibm.com/support/knowledgecenter/en/SS42VS_7.3.2/com.ibm.qradar.doc/t_qradar_adm_asset_tuning_ip_retention.html

A QRadar administrator added High Availability (HA) to the Event Processor and needs to verify the crossover link status between the primary and secondary hosts.

Which commands can be used to verify the crossover status? (Choose two.)

/opt/qradar/ha/bin/ha_getstate.sh
/opt/qradar/ha/bin/getStatus crossover
/opt/qradar/ha/bin/qradar_nettune.pl crossover status
/opt/qradar/ha/bin/qradar_nettune.pl linkaggr <interface> status
/opt/qradar/ha/bin/ha cstate
cat /proc/drbd

Correct answer: CE

Explanation:

Reference: https://www.ibm.com/support/pages/qradar-verifying-ha-crossover-connections-qradarnettunepl

Which event routing rule is required to add QRadar Data Store (QDS) capability to a deployment?

Log Only (exclude Analytics)
Delete data When storage space is required
Bypass Correlation
Delete data immediately after the retention period has expired

Correct answer: A

Explanation:

Reference: https://www.ibm.com/support/knowledgecenter/en/SS42VS_7.3.2/com.ibm.qradar.doc/t_qradar_adm_data_store.html

An administrator is about to integrate logs from a custom firewall in a QRadar deployment using syslog. The SIEM has two domains, namely Domain A and Domain B. While reviewing the following sample logs, the administrator notices a “context” keyword:

May 14 11:05:01 192.168.1.23 20190514 11:05:00 context=contextA permit 192.168.1.24 source: 10.10.1.15; source_port: 64094; destination: 10.10.13.34; service: 53; protocol: udp;

May 13 12:07:01 192.168.1.23 20190513 11:07:00 context=contextB permit 192.168.1.25 source: 10.10.1.15; source_port: 64094; destination: 10.10.13.34; service: 53; protocol: udp;

Which options assign the “contextA” logs to DomainA and the “contextB” logs to domain B? (Choose two.)

Create a single log source, create a “Context” custom event property, and assign the log to both domains using a custom rule.
Create two individual log sources by configuring a separated logging instance for each context on the firewall and assign each log source to the correct domain.
Create a single log source, create a “Context” custom event property, and assign the log to the correct domain using custom event property value.
Create two individual log sources using the context value as log source identifier and assign each log source to the correct domain.
Create a single log source, create a “Context” custom event property, and assign the log to the correct domain using a custom rule.

Correct answer: BD

An administrator plans to deploy multiple log sources that share a common configuration.

How many log sources can be added at one time?

1000
750
250
500

Correct answer: D

Explanation:

Reference: https://www.ibm.com/support/knowledgecenter/SS42VS_DSM/com.ibm.dsm.doc/t_logsource_bulkadd.html

An administrator needs to add the following networks to a QRadar network hierarchy as a single Classless Inter-Domain Routin (CIDR) range:

192.168.64.0/24

192.168.65.0/24

192.168.66.0/24

192.168.67.0/24

What is the correct supernet for these subnets?

Network 192.168.66.0 with subnet mask 255.255.252.0
Network 192.168.64.0 with subnet mask 255.255.252.0
Network 192.168.64.0 with subnet mask 255.255.255.0
Network 192.168.66.0 with subnet mask 255.255.252.0

Correct answer: B

Which log should be reviewed to determine the reasons a patch installer did not proceed during a QRadar upgrade?

/var/log/qradar.audit
/var/log/qradar.log
/var/log/setup-*/patches.log
/var/log/upgrade.log

Correct answer: C

Explanation:

Reference: https://www.ibm.com/support/pages/qradar-unable-run-patch-installer-and-update-exits-screen-terminating-message

Vendor:	IBM
Exam Code:	C1000-026
Exam Name:	IBM Security QRadar SIEM V7.3.2 Fundamental Administration
Date:	Mar 20, 2020
File Size:	24 KB

Download IBM Security QRadar SIEM V7.3.2 Fundamental Administration.C1000-026.ActualTests.2020-03-20.32q.vcex

How to open VCEX files?

Demo Questions

Question 1

Question 2

Question 3

Question 4

Question 5

Question 6

Question 7

Question 8

Question 9

Question 10

ProfExam at a 20% markdown