Free 2021 IBM Security C1000-026 dumps are available on Google Drive shared by TorrentVCE
Welcome to download the newest TorrentVCE C1000-026 PDF dumps: https://www.torrentvce.com/C1000-026-valid-vce-collection.html ( 62 Q&As)
NEW QUESTION 23
A company has several appliances and the administrator needs to copy a file to all appliances to run some tests to verify the integrity of the processes. The /opt/qradar/support/all_servers.sh script can be used to issue commands to all QRadar appliances within the deployment.
What option must be used with the script to copy the file to all appliances in the deployment?
- A. /opt/qradar/support/all_servers.sh -C
- B. /opt/qradar/support/all_servers.sh -p
- C. /opt/qradar/support/all_servers.sh -g
- D. /opt/qradar/support/all_servers.sh -k
Answer: B
Explanation:
Reference:
https://www-01.ibm.com/support/docview.wss?uid=swg21998517
NEW QUESTION 24
An administrator needs to save the nightly QRadar backups on a network storage.
The administrator has established the connection to the network storage.
What should the administrator do next?
- A. Change the Backup Repository Path to the network storage location using the System Settings window.
- B. Change the Backup Repository Path by adding a new Network Activity Rule.
- C. Configure the new network storage using the Assets Manager
- D. Change the Backup Repository Path to the network storage location using the Backup Recovery Configuration window.
Answer: D
Explanation:
Reference:
documents/7.2.8/en/b_qradar_admin_guide.pdf (146)
NEW QUESTION 25
Which event QID test is used to send an email as a rule response when disk usage reaches a threshold?
- A. (38750076) Disk Sentry Disk Usage Exceeded Warning threshold levels
- B. (38750076) Disk Sentry Disk Usage Exceeded Warn threshold
- C. (38750076) Disk Usage Exceeded Warn threshold
- D. (38750076) Disk Sentry Reached Warn threshold
Answer: A
Explanation:
Explanation/Reference: https://www.ibm.com/support/pages/qradar-configuring-qradar-remote-alerts-about-disk-usage
NEW QUESTION 26
An administrator needs to complete the upgrade process from V7.3.1 to V7.3.2.
What is the correct procedure?
- A. Copy the ISO file extension to the recommended directories and use this file
- B. Do a clean installation using the ISO file on a bootable USB device
- C. Copy the SFS file extension to the recommended directories and use this file
- D. Use the ISO file to execute the upgrade process
Answer: C
Explanation:
Reference:
t_qradar_up_ugrad_sys.html
NEW QUESTION 27
An administrator needs to import data into QRadar for a specific use case.
The data that has been provided to the administrator is stored in records that map a key to a value.
Which type of data collection must the administrator create?
- A. Reference map
- B. Reference map of maps
- C. Reference map of sets
- D. Reference set
Answer: A
Explanation:
Explanation/Reference: https://www.ibm.com/support/knowledgecenter/en/SS42VS_7.3.2/com.ibm.qradar.doc/ t_qradar_conifig_rul_resp_reference_set.html
NEW QUESTION 28
An administrator has added a new Event Processor to a QRadar deployment.
How many events per second (EPS) are granted from the temporary license and how many days will those EPS last?
- A. 5000 EPS for a 35 day period
- B. 10000 EPS for a 35 day period
- C. 5000 EPS for a 45 day period
- D. 10000 EPS for a 45 day period
Answer: A
Explanation:
Reference:
c_qradar_adm_license_mgmt.html
NEW QUESTION 29
An administrator installed a new App Host and would like to move the existing applications from the Console to the App Host.
What steps should be performed?
- A. Admin Tab > Extension Management > Move apps
- B. Admin Tab > System Settings > Move apps
- C. Admin Tab > System and License Management > Click to change where apps are run
- D. Admin Tab > Extension Management > Click to change where apps are run
Answer: C
NEW QUESTION 30
An administrator may be asked to collect diagnostic information on one of our main services. For example, ecs-ec.
Commands such as:
/opt/qradar/support/thredtop.sh
/opt/qradar/support/jmx.sh
These commands collect thread and statistical information on the Services pipeline, queues and filters.
How would an administrator identify a list of jmx ports for each service?
- A. grep JMXPORT /opt/qradar/init/*
- B. grep JMXPORT /opt/qradar/systemd/env/*
- C. grep JMXPORT /opt/qradar/system/mem/*
- D. grep JMXPORT /opt/qradar/system/bin/*
Answer: B
Explanation:
Explanation
NEW QUESTION 31
An administrator is tasked to reduce data volumes in the asset database and reduce stale data contributing to asset growth deviation.
How can the administrator tune the configuration of the Asset Profiler?
- A. In the System Configuration section of the Admin, access the Asset Profile Configuration and reduce the retention values for the Asset Profiler Retention Configuration and Save. Next, deploy the changes into the environment for the updates to take effect.
- B. On the navigation menu, click Admin, click the Asset Profile Configuration and reduce the retention values for the Asset Profiler Retention Configuration and Save. On the navigation menu, click Admin and from the Advanced menu, click Restart Event Collection Services. Next, deploy the changes into the environment for the updates to take effect.
- C. In the System Configuration section of the Admin, access the Asset Profile Configuration and increase the retention values for the Asset Profiler Retention Configuration and Save. Next, deploy the changes into the environment for the updates to take effect.
- D. In the System Configuration section of the Admin, access the Asset Profile Configuration and increase the retention values for the Asset Profiler Retention Configuration and Save. On the navigation menu, click Admin and from the Advanced menu, click Restart Event Collection Services. Next, deploy the changes into the environment for the updates to take effect.
Answer: C
Explanation:
Reference:
t_qradar_adm_asset_tuning_ip_retention.html
NEW QUESTION 32
An administrator has been tasked to run all health checks at once using the DrQ command before a major event happens, such as an upgrade.
What does the DrQ command do?
- A. It runs all available checks in /opt/ibm/si/diagnostiq and writes the results in a txt file.
- B. It checks all the available drives on the QRadar managed host and writes the results on a txt file.
- C. It shows all the available drives on the QRadar managed host.
- D. It runs all available checks in /opt/ibm/si/diagnostiq with the checkup mode and with the summary output mode.
Answer: D
Explanation:
Reference:
https://www.ibm.com/support/knowledgecenter/en/SS42VS_7.3.2/com.ibm.qradar.doc/ t_drq_running_health_checks.html
NEW QUESTION 33
An administrator needs to import a list of HR staff logins into a reference set.
Which file type can be used with the import function in the reference set editor window?
- A. json
- B. csv
- C. xls
- D. xml
Answer: B
Explanation:
Reference:
c_qradar_adm_refdata_ui.html
NEW QUESTION 34
An administrator needs data backup.
What information is contained in the data backup?
- A. Audit log information, Event data, Flow data, Report data, Indexes, Log sources
- B. Audit log information, Event data, Flow data, Report data, Indexes
- C. Audit log information, Event data, Indexes, Index management information, Flow data, Report data, Groups
- D. Audit log information, Event data, Indexes, Index management information, Flow data, Report data
Answer: B
Explanation:
Reference:
c_qradar_adm_man_back_recovery.html
NEW QUESTION 35
An administrator would like to categorize discovered assets by port definitions and add this information to a server type building block for further use.
Which QRadar Console functionality should the administrator use?
- A. Admin Tab - Auto Update
- B. Assets Tab - Server Discovery
- C. Admin - Scheduled Scans
- D. Assets Tab - Actions - Scan
Answer: B
Explanation:
Reference:
b_qradar_tuning_guide.pdf
NEW QUESTION 36
An administrator needs to extract a property from an intrusion detection system (IDS) log. Using a regular expression, the administrator wants to extract a specific part of the log showing the matching "policy ID" of the IDS.
Which type of property must the administrator create?
- A. Normalized event property
- B. Custom event property
- C. Custom flow property
- D. Custom asset property
Answer: A
NEW QUESTION 37
An administrator wants to upload a file with information related to network hierarchy instead of using the GUI wizard.
How can the administrator do this?
- A. Install application "Network Hierarchy Management for QRadar"
- B. Upload file using REST API
- C. Modify /opt/qradar/conf/remotenet.conf
- D. Use upload button in Network Hierarchy wizard
Answer: A
Explanation:
Reference:
https://www.ibm.com/support/pages/qradar-restoring-network-hierarchy-using-network-hierarchymanagement- qradar-app-updated
NEW QUESTION 38
An administrator needs to add the following networks to a QRadar network hierarchy as a single Classless Inter-Domain Routin (CIDR) range:
192.168.64.0/24
192.168.65.0/24
192.168.66.0/24
192.168.67.0/24
What is the correct supernet for these subnets?
- A. Network 192.168.64.0 with subnet mask 255.255.255.0
- B. Network 192.168.64.0 with subnet mask 255.255.252.0
- C. Network 192.168.66.0 with subnet mask 255.255.252.0
- D. Network 192.168.66.0 with subnet mask 255.255.252.0
Answer: A
NEW QUESTION 39
An administrator needs to complete the upgrade process from V7.3.1 to V7.3.2.
What is the correct procedure?
- A. Copy the ISO file extension to the recommended directories and use this file
- B. Do a clean installation using the ISO file on a bootable USB device
- C. Copy the SFS file extension to the recommended directories and use this file
- D. Use the ISO file to execute the upgrade process
Answer: C
Explanation:
Reference:
https://www.ibm.com/support/knowledgecenter/SS42VS_7.3.2/com.ibm.qradar.doc/ t_qradar_up_ugrad_sys.html
NEW QUESTION 40
An administrator has been asked to configure a new QRadar console high availability (HA) deployment. Both the primary and secondary consoles have been installed with the QRadar software.
What should the administrator do to complete the HA configuration?
- A. Reinstall the QRadar software on the secondary console using an "HA Recovery Setup".
- B. Select "Secondary Host" on the wizard when adding the secondary host to the deployment.
- C. Add the secondary console to the deployment, and then create the HA host.
- D. Create the HA host to add the secondary console to the deployment.
Answer: C
Explanation:
Reference:
https://www.ibm.com/support/knowledgecenter/SS42VS_7.3.1/com.ibm.qradar.doc/ b_qradar_ha_guide.pdf
NEW QUESTION 41
An administrator wants to upload a file with information related to network hierarchy instead of using the GUI wizard.
How can the administrator do this?
- A. Install application "Network Hierarchy Management for QRadar"
- B. Upload file using REST API
- C. Modify /opt/qradar/conf/remotenet.conf
- D. Use upload button in Network Hierarchy wizard
Answer: A
Explanation:
Explanation/Reference: https://www.ibm.com/support/pages/qradar-restoring-network-hierarchy-using-network-hierarchy- management-qradar-app-updated
NEW QUESTION 42
An administrator would like to extend the functionality of QRadar using an external application.
Which file format is supported to successfully upload an application from the QRadar Console?
- A. .sh
- B. .exe
- C. .tgz
- D. .zip
Answer: D
Explanation:
Explanation/Reference: https://www.ibm.com/support/knowledgecenter/en/SS42VS_7.3.1/com.ibm.appfw.doc/ b_qradar_appframework_devguide.pdf
NEW QUESTION 43
A company has several appliances and the administrator needs to copy a file to all appliances to run some tests to verify the integrity of the processes. The /opt/qradar/support/all_servers.sh script can be used to issue commands to all QRadar appliances within the deployment.
What option must be used with the script to copy the file to all appliances in the deployment?
- A. /opt/qradar/support/all_servers.sh -C
- B. /opt/qradar/support/all_servers.sh -p
- C. /opt/qradar/support/all_servers.sh -g
- D. /opt/qradar/support/all_servers.sh -k
Answer: B
NEW QUESTION 44
An administrator needs to develop advanced filters to retrieve information from the QRadar System pertaining to the top abnormal events of the most bandwidth-intensive IP addresses.
How can the administrator do this?
- A. Use the IBM DataStudio to create the query
- B. Build an AQL query using the QRadar Scratchpad
- C. Combine GROUP BY and ORDER BY clauses in a single query
- D. Build an AQL query using the QRadar GUI using Assets > Search Filter
Answer: C
Explanation:
Reference:
b_qradar_aql.pdf (21)
NEW QUESTION 45
......
Tested Material Used To C1000-026: https://www.torrentvce.com/C1000-026-valid-vce-collection.html