IBM Certification Security QRadar, Associate Analyst 4

Question 1

An analyst wants to identify all failed login attempts to a Windows server in the last hour using QRadar. Which event category should they filter on?

Accepted Answer

Authentication

Answer

QRadar normalizes login-related events under the 'Authentication' high-level category, which covers successful and failed authentication attempts.

Question 2

What is the purpose of a QRadar 'Log Source Extension' (LSX)?

Accepted Answer

It extends or overrides an existing DSM's parsing rules to handle custom or modified log formats

Answer

An LSX allows administrators to customize how QRadar parses events from a log source without modifying the base DSM.

Question 3

In IBM QRadar, what is a 'flow' in the context of Network Activity?

Accepted Answer

A summarized record of a network communication session including source/destination IP, port, bytes, and packets

Answer

A flow is a bidirectional summary record of a network session, derived from NetFlow or similar protocols, showing connection metadata but not payload content.

Question 4

Which QRadar feature allows an analyst to group multiple related offenses together for coordinated investigation?

Accepted Answer

Cases (via QRadar Incident Forensics or offense notes/grouping)

Answer

QRadar allows related offenses to be linked or grouped using notes and assignments, and integrated case management tools can correlate multiple offenses.

Question 5

What does the QRadar 'Relevance' score in an offense measure?

Accepted Answer

How important the targeted asset is based on its assigned weight in the asset model

Answer

Relevance reflects the importance of the targeted destination asset as defined in QRadar's asset model, prioritizing offenses targeting critical systems.

IBM Certification Practice Test

IBM Certification Practice Test

IBM Certification Security QRadar, Associate Analyst 4