IBM Certification Security QRadar, Associate Analyst 5 — Questions and Answers
Question 1: When tuning a noisy QRadar rule that is generating excessive false positives, which approach is most appropriate?
- Add exception conditions (such as trusted IP ranges or known safe users) to the rule's tests to filter benign activity (Correct answer)
- Delete the rule entirely to stop the false positives immediately
- Lower the offense magnitude threshold so the rule stops triggering
- Disable all log sources that are contributing events to the rule
Correct answer: Add exception conditions (such as trusted IP ranges or known safe users) to the rule's tests to filter benign activity
Adding exception conditions or building block exclusions narrows a rule's scope without removing its ability to detect genuine threats.
Question 2: Which QRadar component would an analyst access to review the current health, status, and license consumption of a QRadar deployment?
- System Administration (Admin tab) (Correct answer)
- Network Activity tab
- Offense Manager
- Asset Database
Correct answer: System Administration (Admin tab)
The Admin tab in QRadar provides access to system settings, component health, license metrics (EPS/FPS), and administrative configuration.
Question 3: In QRadar, what is the difference between a 'Reference Set' and a 'Reference Map'?
- A Reference Set stores single values in a list; a Reference Map stores key-value pairs (Correct answer)
- A Reference Set stores key-value pairs; a Reference Map stores single values
- Both store the same data structure but Reference Maps expire automatically
- Reference Sets are read-only while Reference Maps can be updated by rules
Correct answer: A Reference Set stores single values in a list; a Reference Map stores key-value pairs
Reference Sets are flat single-value lists, while Reference Maps associate a key with a single value, enabling lookups like IP-to-username mappings.
Question 4: An analyst observes that a QRadar offense has been 'dormant' for 5 days. What does a dormant offense status indicate?
- No new events matching the offense's rules have occurred within the configured dormancy period (Correct answer)
- The offense was manually hidden by an administrator
- The source device stopped sending logs to QRadar
- The offense has been escalated and awaits approval from a senior analyst
Correct answer: No new events matching the offense's rules have occurred within the configured dormancy period
QRadar marks an offense dormant when no new correlated events have been added to it within the system's configured dormancy interval.
Question 5: Which IBM QRadar certification exam is aligned with the 'Associate Analyst' role validation?
- C1000-026 (IBM Security QRadar SIEM V7.3.2 Fundamental Administration)
- C1000-018 (IBM QRadar SIEM V7.3.2 Associate Analyst) (Correct answer)
- C1000-100 (IBM Security QRadar SOAR)
- COG-135 (IBM Cognos Analytics Author)
Correct answer: C1000-018 (IBM QRadar SIEM V7.3.2 Associate Analyst)
The C1000-018 exam validates foundational QRadar SIEM analyst skills including log source management, offense investigation, and rule creation.
Question 6: What action should an analyst take in QRadar when an offense is confirmed as a true positive security incident requiring remediation?
- Assign the offense to themselves or a team, document findings in the offense notes, and follow the incident response process (Correct answer)
- Immediately delete the offense to clear the queue
- Increase the offense magnitude to 10 manually
- Export the offense to a CSV file and email it to management
Correct answer: Assign the offense to themselves or a team, document findings in the offense notes, and follow the incident response process
Best practice for confirmed incidents is to assign ownership, document investigation steps in notes, and coordinate remediation through the defined IR process.
Question 7: A QRadar analyst wants to detect brute-force login attempts where a single IP makes more than 20 failed authentications within 5 minutes. Which rule element is essential for this?
- A threshold test that counts event occurrences within a defined time window grouped by source IP (Correct answer)
- A flow direction test checking inbound versus outbound traffic
- A geographic anomaly test comparing login origin to previous locations
- A reference set lookup checking the IP against known bad actor lists
Correct answer: A threshold test that counts event occurrences within a defined time window grouped by source IP
Threshold tests count matching events over a configurable time window and can be grouped by fields like source IP to detect volumetric attack patterns.
IBM Certification Security QRadar, Associate Analyst 5
When tuning a noisy QRadar rule that is generating excessive false positives, which approach is most appropriate?