Online Access Free C2150-624 Practice Test

An Administrator working with IBM Security QRadar SIEM V7.2.8 needs to configure the deployment to add a log source from IBM Bluemix.
What protocol is supported for this?

• A.JDBC
• B.WinCollect
• C.TLS Syslog
• D.LEEF

What is a precaution an Administrator should take before beginning an upgrade of IBM Security QRadar SIEM V7.2.8?

• A.Close all open offenses.
• B.Check and close all open messages.
• C.Purge old data and events.
• D.Confirm that a backup of the data is complete.

An Administrator of an IBM Security QRadar SIEM V7.2.8 deployment has configured an asset data source with domain information. This has created several new asset profiles.
What would explain these new asset profiles?

• A.The data in the asset model is domain-aware, this information is applied to all QRadar components, including server discovery.
• B.The asset data source is attempting to process an asset merge. The information from one asset is combined with the information for another asset under the premise that they are actually the same physical asset.
• C.The asset data source parameter "Collateral Damage Potential" was left at the default "Not Defined"
• D.The data in the asset model is used to compare flow data and identify other assets. These assets are added to a "Whitelist" database for asset reconciliation.

Administrators on versions of IBM Security QRadar SIEM older than V7.2.4 must use a specific upgrade path to transition to newer software versions. These requirements are outlined in what technical document?

• A.QRadar Software upgrade progress technical note
• B.IBM latest firmware release notes
• C.Fix Level Recommendation Tool
• D.IBM System Security Interoperation Center (SSIC)

An IBM Security QRadar SIEM V7.2.8 Administrator has been retaining event data for compliance purposes.
Data is no longer necessary and the administrator needs to delete a specific retention bucket.
Where does the Administrator do this configuration?

• A.Admin tab -> Data Sources -> Event retention icon -> Select the event retention bucket -> Delete
• B.Admin tab -> Data Sources -> Event or Flow retention -> Double-click the first empty row in the table
  -> Delete
• C.Admin tab -> Data Sources -> Flow retention icon -> Select the flow retention bucket -> Delete
• D.Administrator needs to reset the SIM and purge the file system