C1000-026 Online Practice Questions and Answers

An administrator needs to know if a custom rule is being correlated correctly. Which QRadar component is responsible for this process?

A. QRadar Event Collector

B. QRadar Console

C. Magistrate

D. QRadar Event Processor

An administrator needs to collect logs from the Command Line Interface (CLI). Which command should the administrator use?

A. /opt/bin/qradar/support/get_logs.sh

B. /opt/support/get_logs.sh

C. /opt/support/qradar/get_logs.sh

D. /opt/qradar/support/get_logs.sh

To comply with specific regulations, an administrator has been requested to increase asset retention to 365 days.

In which QRadar section can the administrator find the asset retention settings?

A. Admin Tab / Asset Retention

B. Assets Tab / Retention settings

C. Admin Tab / System settings

D. Assets Tab / Asset Retention

An administrator needs to import a list of HR staff logins into a reference set.

Which file type can be used with the import function in the reference set editor window?

A. xml

B. csv

C. xls

D. json

An administrator has been tasked to create a saved search that shows a list of multiple login failures for a single user by username. The administrator has done the following:

1.

Selected Last Hour in the view option.

2.

In the Add filter window, selected the search parameter Custom Rule [Indexed].

3.

Selected Equals for Operator.

4.

Selected Authentication for Rule Group.

What is the next step the administrator needs to perform for the Rule option?

A. Select login failures followed by success to the same username

B. Select multiple login failures from the same source

C. Select multiple login failures to the same destination

D. Select multiple login failures for a single username

A company has two different domains in their IBM QRadar system: Domain_A and Domain_B. An administrator has been tasked to create a rule to look only at events that are tagged with Domain_A and ignore rules that are tagged with the other domains.

What domain text should the administrator use to create this rule?

A. is from domain: Domain_A

B. from domain: Domain_A

C. domain is: Domain_A

D. domain is one of: Domain_A

An administrator modified a configuration setting in the Global System Notifications using the QRadar Console Admin tab.

What is the last step to apply changes?

A. Reload Web Server

B. Restart Services

C. Re-login to QRadar console

D. Deploy Changes

An administrator wants to upload a file with information related to network hierarchy instead of using the GUI wizard.

How can the administrator do this?

A. Install application "Network Hierarchy Management for QRadar"

B. Upload file using REST API

C. Modify /opt/qradar/conf/remotenet.conf

D. Use upload button in Network Hierarchy wizard

An administrator needs to save the nightly QRadar backups on a network storage.

The administrator has established the connection to the network storage.

What should the administrator do next?

A. Change the Backup Repository Path to the network storage location using the Backup Recovery Configuration window.

B. Change the Backup Repository Path by adding a new Network Activity Rule.

C. Change the Backup Repository Path to the network storage location using the System Settings window.

D. Configure the new network storage using the Assets Manager

A QRadar upgrade is planned and a maintenance window is scheduled. The administrator must stage the FIXPACK from IBM Fix Central.

Which QRadar FIXPACK file type must the administrator download?

A. RPM

B. IMG

C. SFS

D. XFS