IBM C1000-140 Exam Practice Test Instant Access

Question 1

What must be created before the Use Case Manager app can be used?

AAuthorized Service Token

BSecurity Profile

CCustom DSM

DUser roles

Answer : C

Question 2

Which statement is valid about the SAML authentication feature?

AUsers enter local credentials every time they access QRadar.

BYou cannot use the x509 certificate, only the provided QRadar_SAML certificate.

CYou can integrate QRadar with your corporate identity server to provide single sign-on.

DAuthentication is exchanged by using digitally signed HTML documents.

Answer : C

Question 3

Which component processes unallocated syslog messages, identifies the DSMs that are installed on the system, and then assigns the appropriate log source type to a new log source?

ATraffic analysis

BAutodetect traffic

CDSM discovery analysis

DDiscovery analysis

Answer : A

https://www.ibm.com/support/pages/qradar-understanding-traffic-analysis-and-log-source-auto-detection

Question 4

During an App Host migration, a deployment professional needs to ensure that all the apps are stopped.

Which task will stop the apps from running?

AUse the QRadar API

BUse the Log Activity tab

CReinstall the apps

DGo to each app's configuration

Answer : A

Question 5

For tenant data retention, what is the maximum number of buckets for shared data that can be created per tenant?

B10

CNo limit

D20

Answer : C

Question 6

For tenant data retention, what is the maximum number of buckets for shared data that can be created per tenant?

B10

CNo limit

D20

Answer : B

Question 7

What approach does QRadar take when it imposes EPS license (not hardware) limits on events that temporarily spike above that limit?

AExcessive events in a spike cause a System Notification that advises the customer to increase their EPS license allocation.

BQRadar EPS license allocation is implemented with a hard cutoff to ensure resources are not saturated.

CDuring the spike, excess events are written to a queue, and they are processed after the EPS rate drops.

DQRadar EPS licensing is measured as an average over a 24-hour period, which allows spikes to be handled gracefully.

Answer : D

IBM C1000-140 IBM Security QRadar SIEM V7.4.3 Deployment Exam Practice Test