IBM Exam C2150-614 Topic 2 Question 3 Discussion

Actual exam question for IBM's C2150-614 exam

Question #: 3
Topic #: 2

A Deployment Professional is investigating why a rule has stopped triggering. The rule is configured to monitor certain events from a specific syslog based Log Source. Upon investigation, the Deployment Professional observes that no events are being received by that Log Source in the Log Activity Tab.

The customer has recently reconfigured the sending system but demonstrates that events are still being sent to the QRadar Event Processor. After running a tcpdump on the Event Processor, events are indeed observed coming from the IP address of the sending system.

How can the Deployment Professional find an event in the QRadar GUI to discover which Log Source the events are being processed?

ALog Activity Tab -> Add Filter -> ''Parameter Field'' enter ''Hostname'' and enter a hostname

BNetwork Activity Tab -> Advanced Search -> ''Parameter Field'' select ''Hostname'' and enter a hostname

CLog Activity Tab -> Add Filter -> ''Parameter Field'' select ''PayLoad Contains'' and enter a unique identifier based off the tcpdump data

DNetwork Activity Tab -> Add Filter -> ''Parameter Field'' select ''Payload Contains'' and enter a unique identifier based off the tcpdump data

Show Suggested Answer

Suggested Answer: A

The Network Activity tab allows you to investigate flows being sent to Qradar Network Anomaly Detection in real-time, perform powerful searches, and view network activity using configurable time-series charts. A flow is a communication session between two hosts. Viewing flow information allows you to determine how the traffic is communicated, what is communicated (if the content capture option is enabled), and who is communicating. Flow data also includes details such as protocols, ASN values, IFIndex values, and priorities.

by Venita at Sep 22, 2022, 03:33 PM

Limited Time Offer

25%

Off

Get Premium C2150-614 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Currently there are no comments in this discussion, be the first to comment!