Online Access Free C2150-614 Exam Questions

A Deployment Professional is investigating why a rule has stopped triggering. The rule is configured to
monitor certain events from a specific syslog based Log Source. Upon investigation, the Deployment
Professional observes that no events are being received by that Log Source in the Log Activity Tab.
The customer has recently reconfigured the sending system but demonstrates that events are still being
sent to the QRadar Event Processor. After running a tcpdump on the Event Processor, events are indeed
observed coming from the IP address of the sending system.
How can the Deployment Professional find an event in the QRadar GUI to discover which Log Source the
events are being processed?

• A.Log Activity Tab -> Add Filter -> "Parameter Field" select "PayLoad Contains" and enter a unique
  identifier based off the tcpdump data
• B.Log Activity Tab -> Add Filter -> "Parameter Field" enter "Hostname" and enter a hostname
• C.Network Activity Tab -> Add Filter -> "Parameter Field" select "Payload Contains" and enter a unique
  identifier based off the tcpdump data
• D.Network Activity Tab -> Advanced Search -> "Parameter Field" select "Hostname" and enter a
  hostname

What is the impact on network bandwidth when selecting 'Global' on a rule instead of 'Local' in a
distributed environment?

• A.All events are sent to the QRadar Console for processing and therefore, the QRadar Console uses
  more bandwidth.
• B.All matching events are sent to each QRadar Event Processor for processing and therefore, all Event
  Processor use more bandwidth.
• C.All matching events are sent to the QRadar Console for processing and therefore, the QRadar Console
  uses more bandwidth.
• D.All events are sent to each QRadar Event Processor for processing and therefore, all Events
  Processors use more bandwidth.

A Deployment Professional needs to improve bandwidth when bonding two or more interfaces together.
Which bonding mode option should be used?

• A.mode=7
• B.mode=0
• C.mode=3
• D.mode=1

A Deployment Professional needs to handle event logs from Point-of-Sale (POS) devices on cruise ships
which have sporadic connectivity to the rest of the deployment.
Which appliance can be used to store and forward these events?

• A.QRadar Event Processor 1628
• B.QRadar Event Collector 1501
• C.QRadar Flow Collector 1201
• D.QRadar Flow Processor 1705

A Deployment Professional has a reference list of usernames that is used in rules. The Deployment
Professional needs to be able to remove a username from the reference list when an offense is detected
from a log event.
How can a Deployment Professional accomplish this goal?

• A.As a rule response, select remove from Reference Set option
• B.As a rule response, select execute custom action in order to call REST-API:UPDATE:
  /reference_data/sets/{name}
• C.As a rule response, select execute custom action in order to call REST-API:REMOVE:
  /reference_data/sets/{name}/{value}
• D.As a rule response, select update Reference Set option