Online Access Free C1000-018 Exam Questions

Which filter would an analyst apply in the Log Activity tab to get a list of log sources not reporting to QRadar?

• A.Log source type does not equal active
• B.Log source status does not equal active
• C.Log source status does not equal error
• D.Custom rule equals device stopped sending events

An analyst is performing an investigation regarding an Offense. The analyst is uncertain to whom some of the external destination IP addresses in List of Events are registered.
How can the analyst verify to whom the IP addresses are registered?

• A.Right-click on the destination address, More Options, then IP Owner
• B.Right-click on the destination address, More Options, then Navigate, and then Destination Summary
• C.Right-click on the destination address, More Options, then Information, and then WHOIS Lookup
• D.Right-click on the destination address, More Options, then Information, and then DNS Lookup

An analyst has to perform an export of events within a timeframe, but not all the columns are present in the log view for the time period the analyst has selected. The analyst only needs specific columns exported for an external analysis.
How can the analyst accomplish this task?

• A.Edit the search and select the extra columns, then export the result with Action/Export to XML/Visible Columns. This export is only supported in XML.
• B.Edit the search and select the extra columns, then export the result with Action/Export to XML/Full Export. This export is only supported in XML.
• C.Edit the search result and select the extra columns, then export the result with Action/Export to CSV/Full Export.
• D.Edit the search result and select the extra columns, then export the result with Action/Export to CSV/Visible Columns.

What is the intent of the magnitude of an offense?

• A.It measures the age of the offense.
• B.It measures the importance of the event attached to the offense.
• C.It measures the age of the event attached to the offense.
• D.It measures the importance of the offense.

Why would an analyst update host definition building blocks in QRadar?

• A.To reduce false positives.
• B.To narrow a search.
• C.To stop receiving events from the host.
• D.To close an Offense