QUESTION: 37

An analyst is performing an investigation regarding an Offense. The analyst is uncertain to whom some of the external destination IP addresses in List of Events are registered.
How can the analyst verify to whom the IP addresses are registered?

Right-click on the destination address, More Options, then Information, and then DNS Lookup
Right-click on the destination address, More Options, then IP Owner
Right-click on the destination address, More Options, then Information, and then WHOIS Lookup
Right-click on the destination address, More Options, then Navigate, and then Destination Summary

Answer(s): D

Explanation:

Navigate > View Destination Summary Displays the offenses that are associated with the selected destination IP address.

Reference:

https://www.ibm.com/docs/en/SS42VS_7.3.3/com.ibm.qradar.doc/b_qradar_users_guide.pdf

Reveal Solution Next Question

QUESTION: 38

What could be a reason that an Event Rule is not triggering as expected?

It contains stateful tests but is configured to use a Processors CRE Instance instead of the Consoles CRE Instance.
It contains stateless tests but is configured to use the Console's CRE Instance instead of the Processor's CRE Instance.
It contains stateful and stateless tests but is configured to use a Console's CRE Instance instead of the Processor s CRE Instance.
It contains stateless tests but is configured to use the Processors CRE Instance instead of the Console's CRE Instance.

Answer(s): B

Reveal Solution Next Question

QUESTION: 39

An analyst has been asked to present a report of all the incidents that have been detected by QRadar in the last 24 hours.
How can the analyst achieve this?

Create an Event saved search from the last 24 hours and then using the Reports tab, create a report to make use of the existing saved search.
Create a Common saved search from the last 24 hours and then using the Reports tab, create a report to make use of the existing saved search.
Create an Event saved search from the last 24 hours and then using the Log Activity tab, create a report to make use of the existing saved search.
Create an Offense saved search from the last 24 hours and then using the Reports tab, create a report to make use of the existing saved search.

Answer(s): A

Reveal Solution Next Question

QUESTION: 40

How does the Custom Rule Engine (CRE) evaluates rules?

It runs stateless tests first, then runs stateful tests and evaluates the result.
It runs tests based on the criticality of the test, running the critical ones first.
It runs rule tests line-by-line in order, and continues while tests are true.
It runs all rule tests at the same time, and evaluates the result after all tests are complete

Answer(s): A

Reveal Solution Next Question

Free C1000-018 Exam Braindumps (page: 10)

QUESTION: 37

Explanation:

Reference:

QUESTION: 38

QUESTION: 39

QUESTION: 40