Untitled Quiz

10 Questions

Which port is used for bidirectional traffic between WinCollect agent and QRadar Console?

D. 8413

Which routing mode ensures that no data is lost?

B. Offline

In Offline mode, all data is first stored in the database and then sent to the forwarding destination. This mode ensures that no data is lost; however, delays in data forwarding can occur. More info: Configure IBM® QRadar® to forward data to one or more vendor systems, such as ticketing or alerting systems. You can also forward normalized data to other QRadar deployments. The target system that receives the data from QRadar is known as a forwarding destination. https://www.dumpslink.com/ QRadar ensures that all forwarded data is unaltered.

A. Monitor specific logical groups or services in the network, such as marketing, DMZ, or VoIP

Which direction value means that an undefined local Source IP accesses an external resource?

B. R2R

Which event QID test is used to send an email as a rule response when disk usage reaches a threshold?

B. (38750076) Disk Sentry Disk Usage Exceeded Warn threshold

What can Remote to Remote (R2R) events indicate?

D. Possible network hierarchy misconfiguration

An administrator needs to import a list of HR staff logins into a reference set. Which file type can be used with the import function in the reference set editor window?

A. csv

Which port is used by appliances that provide syslog events to send event data to QRadar components?

A. 514

In the Backup Recovery Configuration section, what is the default retention period?

A. 7 days

On a QRadar appliance, you might see a warning that you cannot connect to port 32006. Which command you will use for determining port information? A. netstat B. nc C. nmap D. psexec

A. netstat

Study Notes

QRadar Configuration

WinCollect agent and QRadar Console use port 1468 for bidirectional traffic.
Offline mode ensures no data is lost, but may cause delays in data forwarding, by storing data in the database before sending it to the forwarding destination.

Forwarding Data

QRadar can forward data to one or more vendor systems, such as ticketing or alerting systems.
Normalized data can also be forwarded to other QRadar deployments.
The target system receiving data from QRadar is known as a forwarding destination.
QRadar ensures that all forwarded data remains unaltered.

Event QID Tests

The "Disk Usage" event QID test is used to send an email as a rule response when disk usage reaches a threshold.

Remote to Remote (R2R) Events

R2R events can indicate that an undefined local Source IP accesses an external resource.

Reference Sets

CSV files can be used with the import function in the reference set editor window to import a list of HR staff logins.

QRadar Appliance

Appliance syslog events are sent to QRadar components using port 514.
The default retention period in the Backup Recovery Configuration section is 30 days.

Troubleshooting

The command netstat is used to determine port information, such as why a QRadar appliance cannot connect to port 32006.