IBM Qradar

Overview

Rewards

FAQs

Overview

IBM Security QRadar offers extensive visibility into network, endpoint, user, and application activities, allowing for in-depth monitoring. It facilitates the collection, normalization, correlation, and secure storage of events, flows, assets, and vulnerabilities. As a result, any suspected attacks or policy breaches are identified and highlighted as offenses, enabling effective incident detection and response.

Take this assessment to know how good you are with this SIEM solution.

Click the Rewards tab for eligibility requirements.

Read the FAQs tab carefully for Instructions before beginning the assessment.

Rewards

NYXPoints are used to generate the Leaderboard (coming soon). They are awarded for achieving a certain score.

200 nyxpoints for a passing score of 80% or more
300 nyxpoints for a perfect score of 100%
Didn’t pass? You still get 30 nyxpoints for attempting the assesment

FAQs

IMPORTANT instructions for taking the Assessment

The timer starts when you click Start Assessment
DO NOT refresh/reload the page or use the back button to navigate away from the page.
Navigating away from the assessment page DOES NOT stop/pause the timer and the will restart the assessment when you come back to it. The answers are NOT saved.

General

There are NO pre-requisites to take this assessment. Take this assessment even if you are completely new to Linux.
The assessment is completely FREE.
Preferably take it in a closed book mode.
DO NOT copy/paste, share or upload questions elsewhere.

Eligible Rewards

300 NyxCoins*

* NyxCoins vary on score

Questions

Minutes

1 %

Passing Score

Time limit: 0

Assessment Summary

0 of 30 Questions completed

Questions:

Information

You have already completed the assessment before. Hence you can not start it again.

Assessment is loading…

You must sign in or sign up to start the assessment.

You must first complete the following:

Results

Assessment complete. Results are being recorded.

Results

0 of 30 Questions answered correctly

Your time:

Time has elapsed

You have reached 0 of 0 point(s), (0)

Earned Point(s): 0 of 0, (0)
0 Essay(s) Pending (Possible Point(s): 0)

Average score
Your score

Categories

Not categorized 0%

Current
Review
Answered
Correct
Incorrect

Question 1 of 30

1. Question
What is the difference between a flow and an event?
- Events occur at a moment/point in time while flows have a certain duration.
- Events can be forwarded to specific destination, but flows cannot.
- Events will allow creation of custom properties, but flows cannot do this.
- Flows only contribute to local correlated rules, while events are global rules.
Correct

Incorrect
Question 2 of 30

2. Question
Which are the most important elements that the Report Wizard use to help create a report?
- Layout, Container, Content.
- Container, Orientation, Layout.
- Report Classification, Date, Layout.
- Pagination Option, Layout, Date.
Correct

Incorrect
Question 3 of 30

3. Question
Which of the following information do log sources provide?
- User login actions.
- Operating system updates.
- Flows created ny users.
- Router configuration files.
Correct

Incorrect
Question 4 of 30

4. Question
Which part of Qradar Dashboard will show events related to a specific offense?
- Offenses Tab and Event List window.
- Offence Summary Page and List of Events window.
- Log Activity Page and List of Events window.
- In Log Activity, search for Events that are associated with an Offense.
Correct

Incorrect
Question 5 of 30

5. Question
Which of the following timestamps are related to a flow in Qradar?
- First Packet Time, Storage Time, Log Source Time, Time to Live.
- First Packet Time, Storage Time, Last Packet Time.
- First Packet Time, Log Source Time, Last Packet Time.
- Time to Live, Storage Time, Log Source Time, End Time.
Correct

Incorrect
Question 6 of 30

6. Question
What can be concluded, by an event on an existing log in QRadar, that has a Low Level Category marked as Unknown?
- The event could not be parsed.
- The event was from an unknown device running unknown protocol.
- That the event generated from a device that is not supported by QRadar.
- The event was parsed, but not mapped to an existing QRadar category.
Correct

Incorrect
Question 7 of 30

7. Question
Which are the two options available in left column of Reports Tab in Qradar Dashboard?
- Reports and Scheduled Reports.
- Reports and Branding.
- Reports and Report Grouping.
- Reports and Report Summary.
Correct

Incorrect
Question 8 of 30

8. Question
What is the function of Device Support Module (DSM) in QRadar?
- Correlates Data from Log sources.
- Provides Vendor configuration information.
- Scans log information based on a set of rules to output offenses.
- Parses event information received from external log sources.
Correct

Incorrect
Question 9 of 30

9. Question
Which QRadar component helps to increase the search efficiency in a deployment by allowing more data to remain uncompressed?
- QRadar Data Node.
- QRadar Flow Processor.
- QRadar Event Collector.
- Qradar Event Processor.
Correct

Incorrect
Question 10 of 30

10. Question
Event magnitude is calculated using which of the following methods?
- As the sum of the three properties Severity, Priority and Relevance of the Event.
- As the sum of the three properties Severity, Credibility, and Importance of the Event.
- As a weighted mean of the three properties, namely Severity, Credibility and Relevance of the Event.
- As a weighted mean of the three properties Priority, Credibility, and Importance of the Event.
Correct

Incorrect
Question 11 of 30

11. Question
Which of the following saved searches can be included in the Qradar Dashboard ?
- Event and Flow saved searches.
- Asset and Vulnerability saved searches.
- Network Activity and Vulnerability saved searches.
- Network Activity and Risk saved searches.
Correct

Incorrect
Question 12 of 30

12. Question
Which type of search in Qradar, uses an Ariel query language to retrieve specified fields from the events and flows?
- Add Filter.
- Asset Search.
- Quick Search.
- Advanced Search.
Correct

Incorrect
Question 13 of 30

13. Question
What is the maximum number of supported dashboards in Qradar for a single user?
- 100
- 10
- 255
- 512
Correct

Incorrect
Question 14 of 30

14. Question
Which of the following QRadar component, provides the GUI that delivers real-time flow views?
- QRadar App Node.
- QRadar Console.
- QRadar Flow Collector.
- QRadar Flow Processor.
Correct

Incorrect
Question 15 of 30

15. Question
What are two functions of a SIEM tool? (Multiple Choice)
- Log Management.
- Network Deployment.
- Endpoint Software patch management.
- Event Normalization & Correlation.
Correct

Incorrect
Question 16 of 30

16. Question
Which of the below is a valid file type for a report format generated from Reporting Tab?
- VHDI
- DOC
- PDF
- PowerPoint
Correct

Incorrect
Question 17 of 30

17. Question
What is the correct type of information found under the Network Activity tab in Qradar Dashboard?
- Flows.
- Events.
- Vulnerabilities.
- Offenses.
Correct

Incorrect
Question 18 of 30

18. Question
What is the most common purpose of analyzing flow data in Qradar?
- To see which users are logged into a remote system.
- To see which users were creating valid reports on Qradar.
- To see application versions installed on a network endpoint.
- To see how much information/data was sent from an internal desktop to a remote website.
Correct

Incorrect
Question 19 of 30

19. Question
Where can user add a note to an offense in the Qradar Dashboard?
- Dashboard and Offenses Tab.
- Offenses Tab and Offense Detail Window.
- Offenses Detail Window, Dashboard, and Log Activity Tab.
- Dashboard, Offenses Tab, and Offense Detail Window.
Correct

Incorrect
Question 20 of 30

20. Question
Which of the following is the default reason for closing an Offense within QRadar Dashboard?
- False Positive
- Non-Issue
- Denied by Firewall
- Acceptable Traffic
Correct

Incorrect
Question 21 of 30

21. Question
What is a basic functionality of building blocks in Qradar?
- A way of designing reusable rule responses.
- A reusable test stack that can be used in other rules.
- A method to generate reference set updates without using a rule.
- A method to create new events back into the pipeline without using any rule.
Correct

Incorrect
Question 22 of 30

22. Question
What is the primary difference between Rules and Building Blocks in QRadar?
- Rules have Actions and Responses; Building Blocks do not have actions and responses.
- Building Blocks are applicable only on flows while rules are for events.
- Building Blocks are pre-built to the Qradar product; Rules are customized for each deployment.
- Building Blocks are rules which are evaluated on Flows and Events; Rules are evaluated on Offenses of Flows or Events.
Correct

Incorrect
Question 23 of 30

23. Question
What is the default tab when a user first logs in to QRadar Console via Web Interface?
- Log Activity.
- Offense Tab.
- Dashboard tab.
- Network Activity Tab.
Correct

Incorrect
Question 24 of 30

24. Question
What is the function of the Network Hierarchy in QRadar SIEM?
- To determine and identify local and remote hosts.
- Capability to move the hosts from local to remote network.
- Viewing real-time packet capture traffic between host groups to isolate malware.
- To allow creating network VPNs for remote access.
Correct

Incorrect
Question 25 of 30

25. Question
Which of the below devices uses signatures for traffic analysis when deployed in a network environment to detect, allow, block, or simulated-block traffic?
- Router
- QRadar
- Switch
- IDS/IPS
Correct

Incorrect
Question 26 of 30

26. Question
What is the correct difference between TCP and UDP?
- TCP is used at Layer 3 of OSI model while UDP works on Application Layer.
- UDP is connectionless, whereas TCP is connection based.
- TCP is connectionless, while UDP is connection based.
- TCP runs on the application layer while UDP uses the Transport layer.
Correct

Incorrect
Question 27 of 30

27. Question
What is the advantage of using a span port, mirror port, or network tap as flow sources for QRadar?
- These sources are more efficient in flow collection.
- These sources show the routing table of the remote system.
- These sources show the username that generated the flow.
- These sources include payload for layer 7 application analysis and deep content inspection.
Correct

Incorrect
Question 28 of 30

28. Question
What is a main function of a Cisco Firepower Threat Defense(FTD)?
- Mainframe Server
- A Switch
- A Firewall
- SIEM device
Correct

Incorrect
Question 29 of 30

29. Question
By default, how often is the information on the Qradar Dashboard refreshed?
- Every 180 seconds
- Every 60 seconds
- Every 10 seconds
- Every 120 seconds
Correct

Incorrect
Question 30 of 30

30. Question
Which protocol can be used to send reports in Qradar?
- HTTP
- SMTP
- SNMP
- Syslog
Correct

Incorrect

Cookie	Duration	Description
cookielawinfo-checkbox-analytics	11 months	This cookie is set by GDPR Cookie Consent plugin. The cookie is used to store the user consent for the cookies in the category "Analytics".
cookielawinfo-checkbox-functional	11 months	The cookie is set by GDPR cookie consent to record the user consent for the cookies in the category "Functional".
cookielawinfo-checkbox-necessary	11 months	This cookie is set by GDPR Cookie Consent plugin. The cookies is used to store the user consent for the cookies in the category "Necessary".
cookielawinfo-checkbox-others	11 months	This cookie is set by GDPR Cookie Consent plugin. The cookie is used to store the user consent for the cookies in the category "Other.
cookielawinfo-checkbox-performance	11 months	This cookie is set by GDPR Cookie Consent plugin. The cookie is used to store the user consent for the cookies in the category "Performance".
viewed_cookie_policy	11 months	The cookie is set by the GDPR Cookie Consent plugin and is used to store whether or not user has consented to the use of cookies. It does not store any personal data.

IBM Qradar

Eligible Rewards

300 NyxCoins*

Assessment Summary

Information

Results

Results

Categories

1. Question

2. Question

3. Question

4. Question

5. Question

6. Question

7. Question

8. Question

9. Question

10. Question

11. Question

12. Question

13. Question

14. Question

15. Question

16. Question

17. Question

18. Question

19. Question

20. Question

21. Question

22. Question

23. Question

24. Question

25. Question

26. Question

27. Question

28. Question

29. Question

30. Question