C1000-156

C1000-156 practice questions, page 4 of 5, with answer review and explanations.

Question 16

When configuring a log source, which protocols are used when receiving data into the event ingress component?

  1. SFTP, HTTP Receiver, SNMP
  2. Syslog, HTTP Receiver, JDBC
  3. Syslog, FTP Receiver, SNMP
  4. Syslog, HTTP Receiver, SNMP

Question 17

When do you consider reconfiguring your QRadar environment to a distributed deployment?

  1. When you need to upgrade the Log Source Manager application
  2. When flow sources reach a threshold of 20 Mbps
  3. When your combined log sources are less than 2000 events per second
  4. When processing or storage expands beyond capacity on your single deployed appliance

Question 18

Which event advanced search query will check an IP address against the Spam X-Force category with a confidence greater than 3?

  1. select * from flows where XFORCE_IP_CONFIDENCE('Malware',sourceip)=3
  2. select * from events where XFORCE_IP_CONFIDENCE('Malware',sourceip)>3
  3. select * from flows where XFORCE_IP_CONFIDENCE('Spam',sourceip)<3
  4. select * from events where XFORCE_IP_CONFIDENCE('Spam',sourceip)>3

Question 19

In a single domain QRadar deployment, which IP addresses are considered local?

  1. Any public IP address
  2. Any private IP address
  3. Any IP address that is defined in the network hierarchy
  4. Any IP address that is not defined in the network hierarchy

Question 20

When adjusting a custom email template, which two elements do you edit to include the customizations?

  1. <subject> <text>
  2. <heading> <text>
  3. <heading> <body>
  4. <subject> <body>