IBM P1000-017 Prüfungsthemen:
| Abschnitt | Gewichtung | Ziele |
|---|---|---|
| Verstehen der Datenquellen von QRadar | 25% | - Protokollquellen
|
| Grundlagen von QRadar SIEM | 30% | - Architektur und Komponenten von QRadar
|
| QRadar on Cloud (QRoC) | 45% | - Architektur von QRoC
|
IBM Technical Sales Foundations for IBM QRadar for Cloud (QRoC) V1 P1000-017 Prüfungsfragen mit Lösungen
1. Which are the key components to perform event collections from third party devices
A) Automatic updates, dashboards, log sources, reports
B) Automatic updates, DSM, log sources, log source protocol
C) Custom action scripts, scripts, notifications, responses, response limiter
D) DSM, log sources, log source protocol, VIS
2. Which is a capabilities gap between on Prem QRadar and QRadar on Cloud
A) QRadar on Cloud is unable to Scale beyond 100K events per second
B) Investigation of the offences logs and data requires generation of support of service ticket
C) Two Datacenters currently hosts QRadar on Cloud Environment
D) Installation of application tokens required IBM operation team interaction
3. What is a qflow
A) An external flow type that can provide high level and low-level categories from the parsed event data
B) An external flow type that can automatically extract numerous fields from unencrypted event payload data
C) An internal flow type that can capture vulnerability assessment information from unencrypted payload data.
D) An internal flow type that can capture a portion of unencrypted payload data and can recognize layer 7 applications
4. When is Dev Ops Authorized to access the Stored Data in QRadar on Cloud?
A) When setting up log sources
B) Anytime
C) When authorized by DevOps Manager
D) Upon the customer request
Fragen und Antworten:
| 1. Frage Antwort: B | 2. Frage Antwort: D | 3. Frage Antwort: D | 4. Frage Antwort: C |
845 Kundenbewertungen
