IBM Certification Security QRadar, Associate Analyst 4 — Questions and Answers
Question 1: An analyst wants to identify all failed login attempts to a Windows server in the last hour using QRadar. Which event category should they filter on?
- Authentication (Correct answer)
- Access
- Exploit
- Policy
Correct answer: Authentication
QRadar normalizes login-related events under the 'Authentication' high-level category, which covers successful and failed authentication attempts.
Question 2: What is the purpose of a QRadar 'Log Source Extension' (LSX)?
- It extends or overrides an existing DSM's parsing rules to handle custom or modified log formats (Correct answer)
- It adds additional physical storage to a QRadar appliance
- It provides a GUI wizard for configuring new log source types
- It connects QRadar to external threat intelligence feeds
Correct answer: It extends or overrides an existing DSM's parsing rules to handle custom or modified log formats
An LSX allows administrators to customize how QRadar parses events from a log source without modifying the base DSM.
Question 3: In IBM QRadar, what is a 'flow' in the context of Network Activity?
- A summarized record of a network communication session including source/destination IP, port, bytes, and packets (Correct answer)
- A real-time packet capture of all traffic on a network segment
- A predefined rule that monitors bandwidth thresholds
- An alert generated when a network connection is refused
Correct answer: A summarized record of a network communication session including source/destination IP, port, bytes, and packets
A flow is a bidirectional summary record of a network session, derived from NetFlow or similar protocols, showing connection metadata but not payload content.
Question 4: Which QRadar feature allows an analyst to group multiple related offenses together for coordinated investigation?
- Cases (via QRadar Incident Forensics or offense notes/grouping) (Correct answer)
- Reference Tables
- Custom Rules
- Saved Searches
Correct answer: Cases (via QRadar Incident Forensics or offense notes/grouping)
QRadar allows related offenses to be linked or grouped using notes and assignments, and integrated case management tools can correlate multiple offenses.
Question 5: What does the QRadar 'Relevance' score in an offense measure?
- How important the targeted asset is based on its assigned weight in the asset model (Correct answer)
- How many events per second are being generated by the source
- The geographic distance between the attacker and the victim
- The number of days since the offense was first created
Correct answer: How important the targeted asset is based on its assigned weight in the asset model
Relevance reflects the importance of the targeted destination asset as defined in QRadar's asset model, prioritizing offenses targeting critical systems.
Question 6: An analyst sees a QRadar rule with the test 'when the event(s) were detected by more than 1 log sources'. What type of test is this?
- Multi-source accumulation test that adds confidence by requiring multiple independent sensors to detect the same event (Correct answer)
- A threshold test counting the total number of events
- A behavioral anomaly test comparing against a baseline
- A reference set lookup test checking a known bad list
Correct answer: Multi-source accumulation test that adds confidence by requiring multiple independent sensors to detect the same event
Requiring multiple log sources to detect the same activity reduces false positives by demanding corroboration from independent devices.
Question 7: What is the correct way to schedule a QRadar report to run automatically every Monday morning?
- Configure the report's schedule to 'Weekly' and select Monday as the day and the desired delivery time (Correct answer)
- Create a custom rule that triggers on Mondays and executes a report action
- Use an AQL query with a SCHEDULE keyword to run on Mondays
- Reports cannot be scheduled; they must always be run manually
Correct answer: Configure the report's schedule to 'Weekly' and select Monday as the day and the desired delivery time
QRadar's reporting module includes built-in scheduling options (daily, weekly, monthly) configurable directly in the report's properties.
IBM Certification Security QRadar, Associate Analyst 4
An analyst wants to identify all failed login attempts to a Windows server in the last hour using QRadar.
Which event category should they filter on?