A Deployment Professional is asked to help create a virtual QRadar SIEM deployment containing a dedicated IBM Security QRadar Console, IBM Security QRadar Risk Manager, and 1 each of IBM Security QRadar SIEM Event and Flow Processors. It needs to handle 20,000 EPS/ 300,000 FPM.
What are the total minimum specs (CPU/RAM) to accomplish this goal?
xx28 collectors and processors use 28 processors and 128 GB of RAM.
xx05 collectors and processors use 12 processors and 64 GB of RAM.
Pair xx28 collectors and processors with the QRadar 3128 (Console) to increase performance.
Note: The IBM Security QRadar 3128 with an upgrade license has the capacity of 300,000 FPM and 15,000 EPS.
What is the procedure to configure basic system settings on an IBM Security QRadar V7.2.7 system once the System Configuration panel is accessed under the Admin Tab?
Procedure to configure system settings.
A Deployment Professional is investigating why a rule has stopped triggering. The rule is configured to monitor certain events from a specific syslog based Log Source. Upon investigation, the Deployment Professional observes that no events are being received by that Log Source in the Log Activity Tab.
The customer has recently reconfigured the sending system but demonstrates that events are still being sent to the QRadar Event Processor. After running a tcpdump on the Event Processor, events are indeed observed coming from the IP address of the sending system.
How can the Deployment Professional find an event in the QRadar GUI to discover which Log Source the events are being processed?
The Network Activity tab allows you to investigate flows being sent to Qradar Network Anomaly Detection in real-time, perform powerful searches, and view network activity using configurable time-series charts. A flow is a communication session between two hosts. Viewing flow information allows you to determine how the traffic is communicated, what is communicated (if the content capture option is enabled), and who is communicating. Flow data also includes details such as protocols, ASN values, IFIndex values, and priorities.
What are the minimum bandwidth and latency parameters required for a high availability IBM Security QRadar SIEM V7.2.7 cluster to assure consistency of data if a company has disaster recovery in another city?
To configure high-availability (HA), you must consider the bandwidth and latency between the primary and secondary HA hosts.
If your HA cluster is using disk synchronization, the following conditions must be met:
* The connection between the primary and secondary HA host has a minimum bandwidth of 1 gigabits per second (Gbps).
* The latency between the primary and secondary HA host is less than 2 milliseconds (ms).
A Deployment Professional is working with a new customer that wishes to deploy IBM Security QRadar SIEM V7.2.7 using a cloud solution.
Which two providers are officially supported for this functionality? (Choose two).
A: IBM QRadar on Cloud allows you to enjoy the benefits and customer support of IBM Security QRadar, but in a hosted deployment.
B: QRadar on Cloud has all the capabilities of IBM Security QRadar SIEM hosted in IBM SoftLayer.
Currently there are no comments in this discussion, be the first to comment!