Certification Overview
This entry level certification is intended for administrators who can demonstrate basic support and technical knowledge of IBM Security QRadar SIEM V7.3.2, including implementation and management of an IBM Security QRadar SIEM V7.3.2 solution.
Overall, these administrators are familiar with product functionality and the security policies. They plan, install, configure, implement, deploy, migrate, upgrade, monitor and troubleshoot the IBM Security QRadar SIEM V7.3.2 software.
Note: The function of specific apps, apart from the two bundled with the product, is out of scope, but the concept of extending the capability of using apps is in scope.
Recommended Skills
Basic knowledge in:
RedHat
Networking
Basic Query Language
Regular Expressions
System architecture design
Security platforms
Requirements
Exam C1000-026: IBM Security QRadar SIEM V7.3.2 Fundamental Administration
The test: contains questions requiring single and multiple answers. For multiple-answer questions, you need to choose all required options to get the answer correct. You will be advised how many options make up the correct answer.
is designed to provide diagnostic feedback on the Examination Score Report, correlating back to the test objectives, informing the test taker how he or she did on each section of the test. As a result, to maintain the integrity of each test, questions and answers are not distributed.
Exam Objectives
The test consists of 5 sections containing a total of approximately 60 multiple-choice questions. The percentages after each section title reflect the approximate distribution of the total question set across the sections.
Number of questions: 60
Number of questions to pass: 40
Time allowed: 90 minutes
Status: Withdrawn
Section 1: Implementing
Plan and design QRadar deployment.
Implement and install QRadar.
Add Managed Hosts.
Section2: Migrating and upgrading
Plan QRadar upgrade and migration.
Review documentation and release notes.
Perform QRadar updates, patches and upgrades.
Perform migration (e.g., backup and restore, import and export content).
Section3: Configuring and Administering task
Configure event flow sources and custom properties.
Maintain configuration and data backups.
Create and administer users, user roles, and security profiles.
Manage the license per allocation.
Create, review and modify rules, building blocks and reference sets.
Configure and manage retention policies (i.e., data and assets).
Create and manage saved searches, index, global views, dashboards and reports.
Deploy and manage applications and content packages.
Configure global system notifications.
Configure and apply network hierarchy.
Configure and manage domain and tenants.
Use the asset database.
Schedule and run a VA scan.
Section4: Monitoring
Monitor QRadar Notifications and error messages.
Review and interpret system monitoring dashboards.
Verify QRadar processes and services.
Monitor QRadar performance.
Use apps and tools for monitoring (e.g., QDI, assistant app, incident overview, DrQ).
Check system maintenance and health of appliances.
Monitor offenses and detect anomalies.
Section5: Troubleshooting
Exam Resources
To prepare for the test, take the first self-study course listed below. It is free-of-charge and covers all the knowledge and skills measured on the test. The second course listed (BQ103), alone will not adequately help you prepare for the test. BQ103 can, however, be used as a supplement to the first self-study course. To register for the second course, click here to contact one of IBM’s Global Training Providers.
(*) Notes:
These learning sources are recommended, but not required before taking this test.
Every effort has been made to make the recommended learning sources as complete and as accurate as possible, but no warranty of fitness is implied. The learning sources provided are on an ‘as is’ basis. IBM shall have neither liability nor responsibility to any person or entity with respect to any loss or damages arising from course or publication content.
You must be logged in to the Security Learning Academy for the link to the self-study course to work properly. If you see an error message after clicking a link, log in and retry the link.
Examkingdom IBM C1000-026 Exam Brain dump pdf , Certkingdom IBM C1000-026 Brain Dumps PDF
Best IBM C1000-026 Certification, IBM C1000-026 Brain Dumps Training at certkingdom.com
QUESTION 1
An administrator needs to import data into QRadar for a specific use case.
The data that has been provided to the administrator is stored in records that map a key to a value.
Which type of data collection must the administrator create?
A. Reference set
B. Reference map of sets
C. Reference map
D. Reference map of maps
Answer: B
QUESTION 2
An administrator needs to know if a custom rule is being correlated correctly.
Which QRadar component is responsible for this process?
A. QRadar Event Collector
B. QRadar Console
C. Magistrate
D. QRadar Event Processor
Answer: D
QUESTION 3
An administrator needs to collect logs from the Command Line Interface (CLI).
Which command should the administrator use?
A. /opt/bin/qradar/support/get_logs.sh
B. /opt/support/get_logs.sh
C. /opt/support/qradar/get_logs.sh
D. /opt/qradar/support/get_logs.sh
Answer: D
QUESTION 4
To comply with specific regulations, an administrator has been requested to increase asset retention to 365 days.
In which QRadar section can the administrator find the asset retention settings?
A. Admin Tab / Asset Retention
B. Assets Tab / Retention settings
C. Admin Tab / System settings
D. Assets Tab / Asset Retention
Answer: C
QUESTION 5
A QRadar administrator added High Availability (HA) to the Event Processor and needs to verify the crossover
link status between the primary and secondary hosts.
Which commands can be used to verify the crossover status? (Choose two.)
A. /opt/qradar/ha/bin/ha_getstate.sh
B. /opt/qradar/ha/bin/getStatus crossover
C. /opt/qradar/ha/bin/qradar_nettune.pl crossover status
D. /opt/qradar/ha/bin/qradar_nettune.pl linkaggr <interface> status
E. /opt/qradar/ha/bin/ha cstate
F. cat /proc/drbd
Answer: C,F
