C1000-140

C1000-140 practice questions, page 2 of 3, with answer review and explanations.

Question 6

What approach does QRadar take when it imposes EPS license (not hardware) limits on events that temporarily spike above that limit?

  1. Excessive events in a spike cause a System Notification that advises the customer to increase their EPS license allocation.
  2. QRadar EPS license allocation is implemented with a hard cutoff to ensure resources are not saturated.
  3. During the spike, excess events are written to a queue, and they are processed after the EPS rate drops.
  4. QRadar EPS licensing is measured as an average over a 24-hour period, which allows spikes to be handled gracefully.

Question 7

What is an approach to tuning a “noisy” rule, that is, a rule that generates too many offenses?

  1. Determine whether the rule matches too many conditions in the traffic.
  2. In the offense output, scroll down and review the “Excessive” flags.
  3. Confirm that the rule is enabled.
  4. Use the QRadar Pulse app to map noisy offense output.

Question 8

Which of these statements is true about network objects?

  1. A network object can have multiple CIDR ranges assigned to it.
  2. A network object must have at least one CIDR range per QRadar domain.
  3. A network object represents a single asset that is connected to a network.
  4. A network object is a group of assets that are connected to a network.

Question 9

A QRadar deployment professional designs a multi-tenant environment where each tenant is permitted a quantity of events per second (EPS). In a discussion with the service provider (who provides the security monitoring services to each tenant), how should the deployment professional describe the licensing options available?

  1. Per-tenant EPS limits can be set, but any events over the EPS will be dropped from the pipeline; over-license buffering will not be used to handle EPS spikes.
  2. Per-tenant EPS limits can be set if the tenants are defined by event collectors. Then over-license buffering can be used to handle EPS spikes.
  3. If each domain and tenant is defined by log source groups, the EPS limit can be shared by the log source groups used for each tenant. Over-license buffering is defined at the event collector.
  4. The domain sets EPS limits, so each tenant needs to have only one domain. This way, over-license buffering can be used to handle EPS spikes.

Question 10

What is the directory where a backup archive file needs to be placed so that QRadar can automatically import it?

  1. /store/imports/inbound
  2. /store/backupHost/inbound
  3. /storetmp/backups
  4. /storetmp/imports/backups