IBM Exam C1000-140 Topic 2 Question 32 Discussion

Actual exam question for IBM's C1000-140 exam

Question #: 32
Topic #: 2

[All C1000-140 Questions]

Which log source should be used to filter QRadar audit events?

AHealth Metrics-2

BSIM Audit-2

CAudit-log

DSIM-Audit-log

Show Suggested Answer

Suggested Answer: D

by Raymon at Apr 11, 2024, 09:23 PM

Limited Time Offer

25%

Off

Get Premium C1000-140 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Lorrie

7 months ago

I think SIM-Audit-log could also be a good option, as it combines SIM and audit logs for comprehensive analysis.

upvoted 0 times

...

Stefany

8 months ago

But SIM Audit-2 has more relevant information for analyzing audit events in QRadar.

upvoted 0 times

...

Milly

8 months ago

I disagree, I believe Audit-log is the best option for filtering QRadar audit events.

upvoted 0 times

...

Stefany

8 months ago

I think the correct log source to filter QRadar audit events is SIM Audit-2.

upvoted 0 times

...

Shonda

8 months ago

That's a good point, Leonor. SIM-Audit-log could also be a valid choice for filtering audit events.

upvoted 0 times

...

Leonor

8 months ago

I feel like D) SIM-Audit-log could also be a good option, as it specifically mentions SIM.

upvoted 0 times

...

Lourdes

8 months ago

I agree with Shonda. Audit-log makes the most sense for filtering QRadar audit events.

upvoted 0 times

...

Shonda

9 months ago

I think the correct log source to filter QRadar audit events is C) Audit-log.

upvoted 0 times

Lorean

8 months ago

I agree, let's go with C) Audit-log.

upvoted 0 times

...

Emiko

8 months ago

I think the correct log source is C) Audit-log.

upvoted 0 times

...

Tasia

9 months ago

Nah, I doubt they'd put a completely irrelevant log source as an option. That would just be cruel.

upvoted 0 times

...

Yuriko

9 months ago

I don't know, I'm still not convinced. The 'Health Metrics-2' option seems a bit suspicious. Maybe that's a trick answer?

upvoted 0 times

...

Stephaine

9 months ago

Haha, yeah, the 'SIM-Audit-log' option is a dead giveaway. It's like they're practically begging us to choose that one.

upvoted 0 times

...

Jesusa

10 months ago

You guys are overthinking this. It's clearly SIM-Audit-log. The question literally has 'SIM Audit' in the answer choices!

upvoted 0 times

...

Loren

10 months ago

I disagree, I think the Audit-log would be the more appropriate choice. It seems like that would be the log source specifically for audit events.

upvoted 0 times

...

Evangelina

10 months ago

Hmm, this is a tricky one. I'm not too familiar with QRadar's log sources, but I think the audit events should be coming from the SIM Audit-2 log source.

upvoted 0 times

...