C1000-163 Sample Questions & Answers

Case Study

A mid-sized regional hospital is deploying QRadar SIEM V7.5 to meet compliance requirements and enhance its security posture. The hospital's network is strictly segmented, with critical patient data systems residing in a high-security zone. All other systems, including clinical workstations and administrative servers, are in a general corporate zone. The CISO has mandated that network traffic between these zones must be monitored for anomalous behavior, but installing agents on the critical systems is strictly forbidden.

The initial deployment consists of a QRadar Console and a combined Event/Flow Processor located in the main data center, which is part of the general corporate zone. The network team has configured the core network switch, which handles all inter-zone traffic, to export NetFlow v9 records. The goal is to capture and analyze all traffic flowing between the high-security and general corporate zones.

To achieve this, the deployment professional plans to add a new QRadar appliance. The appliance must be able to receive the NetFlow data directly from the core switch without requiring an additional network tap or span port. The solution should be cost-effective and specifically designed for this purpose.

Which QRadar appliance should be deployed to collect and process the NetFlow v9 data from the core switch?

After a successful QRadar deployment, the security team reports a high volume of offenses related to 'SSH Brute Force Login Attempts' originating from the internal vulnerability scanner. This is expected and accepted behavior, but it is generating significant noise and distracting analysts from real threats. The team wants to prevent these specific events from generating offenses, but still needs to log the scanner's activity for audit purposes.

Which is the most efficient method to achieve this without globally disabling the rule?

True or False: When deploying a QRadar High Availability (HA) pair, both the primary and secondary appliances must be the same appliance type, have identical hardware, and be running the same QRadar software version and patch level.

A deployment professional is using the QRadar Assistant App to manage applications in a new V7.5 environment. They need to find an application that provides visualizations for MITRE ATT&CK framework mappings. After installing the app, they want to ensure it is running correctly.

Which section of the QRadar Assistant App should be used to check the status of installed applications and their resource consumption?

A system administrator is reviewing QRadar system notifications and frequently sees 'Asset Profile Changed' messages. Upon investigation, they find that asset profiles are being updated with new services and ports based on flow data, which is the desired behavior. However, the sheer volume of these informational notifications is making it difficult to spot more critical system health warnings.

What is the most appropriate action to reduce the noise from these specific notifications while ensuring other system health messages are still delivered?

A deployment professional is outlining the key business drivers for a new QRadar deployment at a retail company. The primary goal is to achieve PCI DSS compliance. The company also wants to reduce the mean time to detect (MTTD) for data breaches and provide the executive team with a high-level view of the company's risk posture.

Which QRadar capabilities should be highlighted to address these specific business needs? (Select THREE).

A deployment is being planned for a company with a peak event rate of 25,000 EPS and a flow rate of 400,000 FPM. They require 90 days of online data retention for both events and flows. The company wants to use dedicated appliances for event and flow processing to ensure optimal performance.

Which combination of appliances would be the minimum required to meet these sizing requirements?

During the initial configuration of a QRadar V7.5 Console, a deployment specialist needs to define the local network to distinguish it from remote or internet-based traffic. This is critical for the proper functioning of many correlation rules, anomaly detection, and asset profiling.

Where in the QRadar user interface is the Network Hierarchy configured?

A financial institution is migrating its QRadar deployment from an on-premises data center to a new hardware platform. The existing deployment is V7.4.3 and the new hardware will run V7.5.0. The security team has developed hundreds of custom rules, reports, and custom properties that must be preserved. The migration window is very short, and reinstalling all content manually is not feasible.

What is the recommended method to transfer this custom content from the old deployment to the new one?

The qradar.log file on an Event Collector shows a large number of messages stating 'Payload contains non-UTF-8 characters'. The associated events are from a legacy industrial control system that uses a custom ASCII encoding. These events are being dropped by the event pipeline before they can be processed.

Which setting on the corresponding Log Source needs to be adjusted to allow QRadar to process these events?