Latest Jan 05, 2022 C1000-055 Brain Dump A Study Guide with Tips & Tricks for passing Exam [Q30-Q46]

Latest Jan 05, 2022 C1000-055 Brain Dump: A Study Guide with Tips & Tricks for passing Exam

C1000-055 Question Bank: Free PDF Download Recently Updated Questions

NEW QUESTION 30
A deployment professional just installed new QRadar deployment which comes with a temporary license key.
How many days does a deployment professional have before the temporarylicensekey expires?

A. 15 days from the installation date.
B. 45 days from the installation date.
C. 35 days from the installation date.
D. 30 days from the installation date.

Answer: D

NEW QUESTION 31
A deployment professional needs to configure network devices to send IPFIX to a QRadar deployment consisting of 1 QRadar Console 3129 and 2 QRadar Event Processors 1629. The routers will send more than 1
000 000 FPM.
Which component should be added to the existing deployment?

A. Flow Processor
B. DataNode
C. AppHost
D. Event Collector

Answer: D

NEW QUESTION 32
A deployment professional needs to clear out the Asset Database in IBM QRadar. Which service on the Console is restarted when script cleanAssetModel.sh is executed?

A. PostgressDB
B. Hostcontext
C. Hostservices
D. Tomcat

Answer: C

NEW QUESTION 33
A deployment professional needs to find out which rules are generating most of the offenses. What should the deployment professional do? (Choose two)

A. Generate Report "System Summary"
B. Offenses -> Rules -> Sort by Offense Count
C. Use search where Log source is Health Metrics-2 :: <qradar hostname> and choose Grouping by Event Name
D. Use search where Log source is Custom Rule Engine-8 :: <qradar hostname> and choose Grouping by Event Name
E. Offenses -> By Category

Answer: A,B

NEW QUESTION 34
A deployment professional needs to implement a crossover cable in the high availability (HA) environment.
By doing so, this QRadar deployment isolates what kind of traffic over the crossover connection?

A. query
B. flow
C. event
D. HA replication

Answer: C

NEW QUESTION 35
A deployment professional has been asked to create some Reference Data to identify activity on executive's email addresses. The customer has provided the list of the current email addresses and has stated that these need to be updated from time to time as the organization changes. Changes should be handled in the standard Graphical User Interface (GUI) of the QRadar Console.
Which Reference Data should the deployment professional create for this purpose?

A. Reference Set
B. Reference Table
C. Reference Map Of Sets
D. Reference Map

Answer: A

NEW QUESTION 36
A deployment professional is faced with the following system notification.
38750107 - The last attempt to read in rules (usually due to a rule change) has failed. Please see the message details and error log for information on how to resolve this.
What should the deployment professional do after trying to disable and enabling the rule?

A. Modify the rule.
B. Create a new rule without deleting the old rule.
C. Before doing anything else, call customer support.
D. Delete and recreate the rule.

Answer: C

NEW QUESTION 37
A deployment professional needs to configure the X-Force Threat Intelligence Feed through a web proxy to access the cloud servers hosting the information.
How should the deployment professional configure the proxy for this access?

A. Complete the 'Server Config' values in the Advanced Update Configuration section of Auto Updates )
B. Edit the Vetc/httpd/conf.d/ssl.conf and Vopt/qradar/dca/server.ini' files on the Console and restart some services
C. Complete the 'System Proxy' values in the Advanced System Settings section of the Admin tab
D. Reconfigure iptables access on each managed host to provide access to 'update.xforce-security.com' and
'license.xforce-security.com' and restart some services

Answer: C

NEW QUESTION 38
As a small company has grown, no standard was defined. Each time the network was expanded, the bid with the lowest cost was accepted. As a result, the infrastructure is a mix of equipment from different manufactures.
A deployment professional is planning on standardizing flow collection. Which flow source data format should the deployment professional use?

A. NetFlow
B. sFlow
C. J-Flow
D. A-Flow

Answer: B

NEW QUESTION 39
A customer is building a big data solution which aims to perform long term analysis of security data. Security events that are processed by QRadar are also relevant for the system and according to the QRadar administrator the most straightforward option for data ingestion is to configure event forwarding on QRadar.
The customer would like to make use of QRadar's parsing capability and its built-in parsers instead of developing new parsers for the big data platform. A deployment professional is asked for advice about the data format to configure for the event forwarding.
Which available option should the deployment professional propose?

A. XML
B. Normalized
C. JSON
D. Payload

Answer: B

NEW QUESTION 40
A QRadar customer has a custom log source. The deployment professional has already created a custom DSM for the log source and all incoming events are correctly parsed and mapped to a QID. Now, in addition to the currently parsed properties, the customer requires that the information about the last logged in user is recorded in the asset database.
How can the deployment professional fulfill the requirement?

A. Use the DSM editor to ensure that the Username property is correctly parsed. Create an expression for any available identity property and ensure it is correctly parsed. Also, in the DSM editor, enable the identity data for the login success event type.
B. Use the DSM editor to create an expression for the Username property so it is correctly parsed. Create an expression for any available identity property and make sure it is correctly parsed. It is automatically applied to all events with low level category "User login success".
C. Use the DSM editor to create an expression for the Identity Username property and make sure it parses correctly. It is automatically applied to all events with low level category "User login success".
D. Use the DSM editor to ensure that the Identity Username property is correctly parsed. Create an expression for any available identity property and ensure it is correctly parsed. Also, in the DSM editor enable identity data for the login success event type.

Answer: C

NEW QUESTION 41
A company has a large network with multiple segments. The manufacturing area network and the research and development (R&D) area network are separated from the product area network, and the customer does not want to run scanners through firewalls. A deployment professional has been tasked with proposing a strategy to ensure vulnerability assessment operations cover all company assets.
In addition to a scanner in the production area network, which option should the deployment professional follow?

A. Deploy a vulnerability processor on a QRadar Managed Host in the manufacturing area network and in the R&D area network.
B. Deploy a vulnerability manager on a QRadar Managed Host in the manufacturing area network and in the R&D area network.
C. Deploy a hosted IBM scanner appliance in the manufacturing area network and in the R&D area network.
D. Deploy a vulnerability scanner on a QRadar Managed Host in the manufacturing area network and in the R&D area network.

Answer: A

NEW QUESTION 42
A deployment professional needs to include a network inspection device in a banking organization as per the new security guidelines. Real time threat investigation has to be done along with the post-incident analysis. A QRadar Incident Forensics has been included in the design for post-incident forensic analysis.
Which devices should be chosen for the realtime analysis?

A. Flow Collector (FC) and QRadar Network Insight (QNI)
B. Flow Collector (FC) and Flow Processor (FP)
C. QRadar Network Insight (QNI) and Flow Processor (FP)
D. Network PCAP and Flow Processor (FP)

Answer: D

NEW QUESTION 43
A deployment professional needs to check which rules cause events to be dropped on the Console with Pipeline NATIVE_To_MPC messages.
Which script would help with this task?

A. /opt/qradar/support/findRules.sh
B. /opt/qradar/support/findExpensiveCustomProperties.sh
C. /opt/qradar/support/astat.sh
D. /opt/qradar/support/findExpensiveCustomRules.sh

Answer: C

NEW QUESTION 44
A customer has a Network Vulnerability Scanner which is not supported by IBM QRadar.
How can a deployment professional integrate such a scanner with IBM QRadar?

A. Creating a uDSM using the DSM Editor
B. Using the AXIS Scanner option of IBM QRadar
C. By creating a Log Source Extension (LSX)
D. Using a Custom Flow Source

Answer: B

NEW QUESTION 45
A deployment professional decides to improve visibility in the network and successfully installs the Flow Collector.
What should the deployment professional connect the Flow Collector to?