P1000-017 by IBM Valid Free Exam Practice Test

IBM Technical Sales Foundations for IBM QRadar for Cloud (QRoC) V1 - P1000-017 Exam Practice Test

Question 1

Which QRadar type of rules can test against both incoming event and flow data?

A. Common Rules B. Offences Rules C. Flow rules D. Event Rules

Correct Answer: A

Question 2

Which appliance types can collect flows and events from all log sources on premises to send to Qradar on cloud?

A. Data only B. Data gateway C. Data store D. Data node

Correct Answer: B

Question 3

How are investigations performed from event and flow data?

A. Via indexing all properties in QRadar B. Via Vulnerability scans C. Via log source management D. Via the log activity and network activity tabs

Correct Answer: D

Question 4

What does it mean to normalize the information found in raw events in Qradar SIEM

A. To map information to common field names B. To transform packets in to flows C. To store raw data in compressed state D. To test data against custom rule engine

Correct Answer: A