Free IBM Security QRadar SIEM V7.5 Administration Practice Questions

Sample Practice Questions

Try these 10 sample questions from the IBM Security QRadar SIEM V7.5 Administration practice bank. Each includes the answer and explanation. Continue with the interactive practice above to review the full question set.

1. 1In a deployment with separate event collector and event processor appliances, how can an administrator increase the collector's EPS capacity?

   1. A.Allocate more pool EPS to its parent event processor.Correct answer: A
   2. B.Allocate more pool FPM to its parent event processor.
   3. C.Allocate more pool EPS directly to the event collector.
   4. D.Allocate more pool FPM directly to the event collector.

   Explanation: IBM states: "To increase the capacity of the event collector, allocate more EPS from the shared license pool to the parent event processor." The collector inherits its EPS rate from the attached processor, so the adjustment belongs on that processor.

   Reference: IBM Security QRadar Administration Guide — Chapter 3, Shared license pool, p. 58

2. 2A log source sends incorrect asset information and cannot be fixed. Which configuration can prevent the affected events from supplying asset updates?

   1. A.Use a real-time identity exclusion search matching the affected events.Correct answer: A
   2. B.Use a real-time identity exclusion search matching only unaffected events.
   3. C.Add the incorrect values to the asset allowlist.
   4. D.Use a historical-only identity exclusion search matching the affected events.

   Explanation: IBM states: "If the log source cannot be fixed, you can build an identity exclusion search that blocks the asset information from entering the asset database." IBM also says: "you must select Real Time (streaming) in the Timespan options." The filter must match the affected events in the live stream.

   Reference: IBM Security QRadar Administration Guide — Asset management, Identity exclusion searches, p. 307

3. 3Several NetFlow exporters send to the same port on a QRadar Flow Collector. What can distinguish the external sources in QRadar?

   1. A.Create flow source aliases using each exporter's IP address.Correct answer: A
   2. B.Create flow source aliases using their shared destination IP.
   3. C.Create flow source aliases using their shared destination port.
   4. D.Create flow source aliases using the same IP for every exporter.

   Explanation: IBM states: "By using flow source aliases, you can identify the different NetFlow sources based by their IP addresses." Aliases distinguish sources that send the same flow type to the shared port.

   Reference: IBM Security QRadar Administration Guide — Flow sources, Flow source aliases, p. 261

4. 4Which anomaly detection rule type evaluates event and flow traffic against seasonal levels and trends?

   1. A.Behavioral ruleCorrect answer: A
   2. B.Threshold rule
   3. C.Event correlation rule
   4. D.Flow correlation rule

   Explanation: The guide states: "Behavioral rules test event and flow traffic according to" seasonal "traffic levels and trends." A threshold rule instead tests against configured limits.

   Reference: IBM QRadar User Guide — Rules, Anomaly detection rules, pp. 194–196

5. 5Which account change temporarily revokes a user's QRadar access without deleting the user account?

   1. A.Select Disabled in the account's User Role list.Correct answer: A
   2. B.Change the inactivity timeout while keeping the role active.
   3. C.End the current session while keeping the role active.
   4. D.Assign a different role that still permits the user to log in.

   Explanation: IBM states: "The option to disable a user account temporarily revokes a user's access without deleting the account." The procedure selects Disabled from the User Role list.

   Reference: IBM Security QRadar Administration Guide — User management, Disabling a user account, p. 29

6. 6Which data period does a weekly scheduled QRadar report use?

   1. A.The previous calendar week, Monday through SundayCorrect answer: A
   2. B.The seven days immediately preceding each run
   3. C.The current calendar week through the run time
   4. D.The previous calendar month

   Explanation: IBM states: "Schedules the report to generate weekly using the data from the previous calendar week, from Monday to Sunday." The weekly schedule uses the preceding calendar week.

   Reference: IBM QRadar User Guide — Report management, Creating custom reports, pp. 222–224

7. 7Two divisions have different devices using the same IP address. How can QRadar distinguish their data in a shared deployment?

   1. A.Assign the sources to separate domains.Correct answer: A
   2. B.Assign both sources to the same domain.
   3. C.Use separate security profiles while keeping both sources in one domain.
   4. D.Rename both sources while keeping them in one domain.

   Explanation: IBM states: "By creating domains that represent a particular address space on the network, multiple devices that are in separate domains can have the same IP address and still be treated as separate devices." Separate domains distinguish the overlapping address spaces.

   Reference: IBM Security QRadar Administration Guide — Domain segmentation, Overlapping IP addresses, p. 273

8. 8An accumulator-falling-behind notification appears. What happens to raw events and flows for the affected interval?

   1. A.Raw events and flows remain on disk; accumulations can be incomplete.Correct answer: A
   2. B.Raw events and flows are lost; accumulations remain complete.
   3. C.Raw events and flows remain on disk; accumulations are always complete.
   4. D.Both raw events and accumulations are deleted for the interval.

   Explanation: IBM states: "You do not lose data when this problem occurs. All raw data, events, and flows are still written to disk. Only the accumulations, which are data sets that are generated from stored data, are incomplete." The notification concerns the aggregated data rather than raw-data loss.

   Reference: IBM QRadar Troubleshooting and System Notifications Guide — QRadar system notifications, Accumulator is falling behind, p. 39

9. 9What happens to excess events and flows when a temporary incoming spike exceeds the allocated EPS and FPM limits?

   1. A.Excess data is queued until the incoming rate slows.Correct answer: A
   2. B.Excess data is processed immediately above the limit.
   3. C.Excess data is discarded whenever the limit is reached.
   4. D.Excess data is queued until the license is reallocated.

   Explanation: IBM explains: "When QRadar receives a data spike that causes it to exceed the allocated EPS and FPM limits, the extra events and flows are moved to a temporary queue to be processed when the incoming data rate slows." The queue holds the excess until processing can catch up.

   Reference: IBM Security QRadar Administration Guide — Chapter 3, Burst handling, p. 60

10. 10Which search time range must be selected when saving an identity exclusion search so that it matches incoming live events?

    1. A.Last 5 minutes
    2. B.Last 24 hours
    3. C.Real Time (streaming)Correct answer: C
    4. D.Last 7 days

    Explanation: IBM states: "when you save the search, you must select Real Time (streaming) in the Timespan options." A historical time range does not match the live event stream.

    Reference: IBM Security QRadar Administration Guide — Asset management, Creating identity exclusion searches, p. 308