Download IBM Security QRadar SIEM V7-2-7 Deployment.PracticeTest.C2150-614.1e.35q.vcex

QRadar provides authentication options for both local and external authentication methods, such as Active Directory or LDAP. 
The QRadar Administrative roles have both the external and local authentication methods available in case the external authentication method fails. If the remote authentication fails, the Administrative users can login using the local password. 
References: http://www-01.ibm.com/support/docview.wss?uid=swg21959344

To reset the IMM password use the following command:
/opt/ibm/toolscenter/asu64 set IMM.Password.1 NewPassword --kcs 
References: http://www-01.ibm.com/support/docview.wss?uid=swg21964070

You can monitor network traffic by sending raw data packets to a IBM QRadar QFlow Collector 1310 appliance. The QRadar QFlow Collector uses a dedicated Napatech monitoring card to copy incoming packets from one port on the card to a second port that connects to a IBM Security QRadar Packet Capture appliance. 
References: http://www.ibm.com/support/knowledgecenter/SSKMKU/com.ibm.qradar.doc/t_qflow_forward_pcap.html

The script "findExpensiveCustomRules.sh" script is designed to query the QRadar data pipeline and report on the processing statistics from the Custom Rules Engine (CRE). The script monitors metrics and collecting statistics on how many events hit each rule, how long it takes to process a rule, total execution time and average execution time.  When the script completes it turns off these performance metrics. The findExpensiveCustomRules script is a useful tool for creating on demand reports for rule performance, it is not a tool for tracking historical rule data in QRadar. The core functionality of this script is often run when users begin to see drops in events or events routed to storage between components in QRadar. 
References: http://www-01.ibm.com/support/docview.wss?uid=swg21985252&myns=swgother&mynp=OCSSBQAC&mync=R&cm_sp=swgother-_-OCSSBQAC-_-R

The IBM Security QRadar Event Processor 1605 (MTM 4380-Q1E) appliance is a dedicated event processor that you can scale your QRadar deployment to manage higher EPS rates. The QRadar Event Processor 1605 appliance includes an on-board event collector, event processor, and internal storage for events. 
With the Basic License the capacity is 2500 EPS, and with an upgrade license it is 20000 EPS. 
Incorrect Answers:
A: The IBM Security QRadar QFlow Collector 1202 (MTM 4380-Q3C) appliance provides high capacity and scalable Layer 7 application data collection for distributed deployments.
B: The IBM Security QRadar 1400 Data Node (MTM 4380-Q1E) appliance provides scalable data storage solution for QRadar deployments. The QRadar 1400 Data Node enhances data retention capabilities of a deployment as well as augment overall query performance.
C: The IBM Security QRadar Event Collector 1501 (MTM 4380-Q2C) appliance is a dedicated event collector. By default, a dedicated event collector collects and parses event from various log sources and continuously forwards these events to an event processor. The capacity is 15000 Events per Second.
References: http://www.ibm.com/support/knowledgecenter/SS42VS_7.2.6/com.ibm.qradar.doc/c_hwg_evt_prcssr1605.html

If you select Local, all rules are processed on the Event Processor on which they were received and offenses are created only for the events that are processed locally. 
If you select Global, all matching events are sent to the QRadar Console for processing and therefore, the QRadar Console uses more bandwidth and processing resources. 
References: http://www.ibm.com/support/knowledgecenter/SSKMKU/com.ibm.qradar.doc/t_qradar_create_cust_rul.html

Use the BB:PortDefinition: Mail Ports building block to include all common ports used by mail servers.
References: Juniper Security Threat Response Manager STRM Log Manager Users Guide Release 2012.0, page 159

The QRadar 3105 (All-in-One) appliance requires external QRadar QFlow Collectors for layer 7 network activity monitoring. 
With an upgraded licence the QRadar  Flow Processor 1705 supports  600,000 FPM, depending on traffic types. 
Note: The IBM Security QRadar 3105 (All-in-One) (MTM 4380-Q1E) appliance is an all-in-one QRadar system that can profile network behavior and identify network security threats.
With a basic license it supports 25,000 FPM and 1000 EPS. 
With an upgraded license it supports 200,000 FPM and 5000 EPS.  
Incorrect Answers:
A: With an upgraded licence the QRadar 1805supports 200,000 FPM and 5,000 EPS.
C: With an upgraded licence the QRadar  Flow Processor 1828 supports 300,000 FPM.
D: QRadar Event Processor 1605 is not a Flow Collector.
References: 
http://www.ibm.com/support/knowledgecenter/SS42VS_7.2.8/com.ibm.qradar.doc/c_hwg_3105_allone_base.html
http://www.ibm.com/support/knowledgecenter/SS42VS_7.2.6/com.ibm.qradar.doc/c_hwg_flow_prcssr1705.html

An Event Collector is an appliance for collecting events in remote locations for periodic forwarding to an Event Processor or an all-in-one appliance. 
An example is the IBM Security QRadar Event Collector 1501 (MTM 4380-Q2C) appliance, which is a dedicated event collector. By default, a dedicated event collector collects and parses event from various log sources and continuously forwards these events to an event processor. 
References: http://www.ibm.com/support/knowledgecenter/SS42VS_7.2.8/com.ibm.qradar.doc/c_hwg_eventcllctr1501.html

Create and share the Search Criteria, that the Dashboard Item will use. 
The user account initiating this process must be in the Admin User Role. Only users in the Admin User Role have the ability to share saved Search Criteria. 
Assign Search to Group(s): Select the check box for the group you want to assign this saved search. If you do not select a group, this saved search is assigned to the Other group by default.
References: http://www-01.ibm.com/support/docview.wss?uid=swg21679314