IBM Certification Security QRadar, Associate Analyst 3 — Questions and Answers
Question 1: Which QRadar search field would an analyst use to find all events sourced from a specific subnet, such as 192.168.1.0/24?
- sourceip INCIDR '192.168.1.0/24' (Correct answer)
- source CONTAINS '192.168.1'
- src_network = '192.168.1.0/24'
- iprange source '192.168.1.0/24'
Correct answer: sourceip INCIDR '192.168.1.0/24'
In AQL, the INCIDR operator is used to match IP addresses within a specified CIDR range.
Question 2: What is a QRadar 'Building Block' rule?
- A rule that tests a condition and can be reused as a test component inside other rules (Correct answer)
- A predefined report template included with QRadar
- A hardware unit that adds processing capacity to a QRadar deployment
- A saved AQL query that runs on a schedule
Correct answer: A rule that tests a condition and can be reused as a test component inside other rules
Building Blocks are rules that do not generate offenses on their own but can be referenced as reusable test conditions by other rules.
Question 3: An analyst needs to view network communication patterns between two hosts over the past 24 hours. Which QRadar tab provides the most relevant data?
- Network Activity (Correct answer)
- Log Activity
- Offenses
- Assets
Correct answer: Network Activity
The Network Activity tab displays flow data (NetFlow, sFlow, J-Flow) showing communication patterns, ports, bytes, and packets between hosts.
Question 4: What is the maximum number of responses a custom rule can have in IBM QRadar?
- Multiple responses can be configured, including email, SNMP trap, and offense creation simultaneously (Correct answer)
- Only one response per rule is allowed
- A maximum of three responses are allowed per rule
- Rules can only respond by creating an offense with no additional actions
Correct answer: Multiple responses can be configured, including email, SNMP trap, and offense creation simultaneously
QRadar custom rules support multiple simultaneous response actions such as creating an offense, sending email, dispatching an SNMP trap, and adding to a reference set.
Question 5: In QRadar's offense management, what does 'closing an offense with reason: Non-Issue' indicate?
- The offense was investigated and determined to be a false positive or benign activity (Correct answer)
- The offense was resolved by patching the affected system
- The offense is being escalated to a higher-priority team
- The offense will automatically reopen if the same activity occurs again
Correct answer: The offense was investigated and determined to be a false positive or benign activity
Closing an offense as 'Non-Issue' documents analyst judgment that the triggered activity was not a real security threat.
Question 6: Which QRadar component performs the actual correlation of events and flows against defined rules in a distributed deployment?
- Event Processor (Correct answer)
- Event Collector
- Flow Collector
- Data Node
Correct answer: Event Processor
The Event Processor normalizes events and runs rule correlation; in a distributed setup multiple Event Processors share the load.
Question 7: What is the function of the 'credibility' score in a QRadar offense?
- It indicates how reliable the log source reporting the event is considered to be (Correct answer)
- It measures how many endpoints were affected by the attack
- It reflects the business impact of the compromised asset
- It tracks how long the offense has been active without being closed
Correct answer: It indicates how reliable the log source reporting the event is considered to be
Credibility reflects confidence in the accuracy of the reporting log source, helping analysts weigh whether an event is a genuine indicator.
IBM Certification Security QRadar, Associate Analyst 3
Which QRadar search field would an analyst use to find all events sourced from a specific subnet, such as 192.168.1.0/24?