C1000-156

C1000-156 practice questions, page 2 of 5, with answer review and explanations.

Question 6

An administrator receives a file with all the vital assets in the company and wants to import this file into QRadar. How must this import file be formatted?

  1. JSON file in the format: IP address, Name, Weight, Domain
  2. XML ile in the format: IP address, Name, Weight, Domain
  3. CSV file in the format: IP address, Name, Weight, Description
  4. XLS file in the format: IP address, Name, Weight, Description

Question 7

An administrator wants to export a list of events to a CSV file. Which items are in the default columns of the search result?

  1. Protocol, Storage Time, Destination Port, Source Port
  2. Log Source, Event Count, High Level Category, Related Offense
  3. Event Name, Application, Username, Log Source
  4. Username, Source Port, Event Count, Magnitude

Question 8

An administrator would like to optimize event and flow payload searches for log data that is stored for up to a month. What does an administrator need to do to achieve that requirement?

  1. Configure the retention period for search indexes.
  2. Configure the retention period for property indexes.
  3. Perform a clean on the search model.
  4. Configure the retention period for payload indexes.

Question 9

To detect outliers, which Anomaly Detection Engine rule tests events or flows for volume changes that occur in regular patterns?

  1. Threshold rules
  2. Anomaly rules
  3. Building block rules
  4. Behavioral rules

Question 10

Which authentication type in QRadar encrypts the username and password and forwards the username and password to the external server for authentication?

  1. RADIUS authentication
  2. Two-factor authentication
  3. TACACS authentication
  4. System authentication