C1000-163 IBM Certification Practice Questions
Uploaded by
certquestionsbankC1000-163 IBM Certification Practice Questions
Uploaded by
certquestionsbankThis PDF contains a set of carefully selected practice questions for the
C1000-163 exam. These questions are designed to reflect the
structure, difficulty, and topics covered in the actual exam, helping you
reinforce your understanding and identify areas for improvement.
What's Inside:
1. Topic-focused questions based on the latest exam objectives
2. Accurate answer keys to support self-review
3. Designed to simulate the real test environment
4. Ideal for final review or daily practice
Important Note:
This material is for personal study purposes only. Please do not
redistribute or use for commercial purposes without permission.
For full access to the complete question bank and topic-wise explanations, visit:
CertQuestionsBank.com
Our YouTube: https://www.youtube.com/@CertQuestionsBank
FB page: https://www.facebook.com/certquestionsbank
Share some C1000-163 exam online questions below.
1.While reviewing apps in QRadar Assistant, an analyst wants to view the apps that work properly.
What sort option should the analyst choose?
A. Running
B. Installed
C. Error/Stopped
D. Install Failed
Answer: A
2.What custom property types does QRadar support?
A. JAR, LEEF, JSON
B. ASN.1, JSON, Regex
C. LEEF, JSON, Regex
D. JSON, LEEF, STIX2
Answer: C
3.When you install QRadar, the default license key is temporary and gives you access to the system
for __________days from the installation date.
A. 50
B. 60
C. 35
D. 45
Answer: C
4.What is a difference between a flow and an event?
A. A flow is a record from a log source, such as a firewall or router device, that describes an action on
a network. An event analysis provides visibility into layer 7 for applications such as web browsers,
NFS, SNMP, Telnet, and FTP.
B. A flow occurs at a moment in time while events have a duration from a log source.
C. An event is a record from a log source, such as a firewall or router device, that describes an action
on a network. A flow record provides visibility into layer 7 for applications such as web browsers,
NFS, SNMP, Telnet, and FTP.
D. An event occur at a moment in time while flows have a duration from the flow source.
Answer: C
5.An organization's QRadar deployment was reviewed. It was determined that more storage is
needed.
Which appliance should be deployed to meet this need?
A. App Host
B. Data Node
C. Flow Collector
D. Event Collector
Answer: B
6.Which port is used for bidirectional traffic between WinCollect agent and QRadar Console?
A. 8082
B. 8844
C. 8080
D. 8413
Answer: D
7.Which of the following is used to process flows in Qradar?
A. Event Collector
B. Flow Processor
C. Event Processor
D. Flow Collector
Answer: B
8.What file format is supported to perform a bulk load of data into a reference set?
A. JSON
B. XML
C. CSV
D. TAXII
Answer: C
9.Which script can detemine which QRadar process is consuming the most resources?
A. /opt/ibm/si/diagnostiq
B. /opt/qradar/support/threadTop.sh
C. /opt/qradar/bin/threadTop.sh
D. /opt/qradar/conf/threadTop.sh
Answer: B
10.Which log source should be used to filter QRadar audit events?
A. Health Metrics-2
B. SIM Audit-2
C. Audit-log
D. SIM-Audit-log
Answer: D
11.Which QRadar app displays time series graphs for queries?
A. Log Management App
B. Pulse
C. Threat Intelligence
D. Assistant for Watson
Answer: B
12.What is the directory where a backup archive file needs to be placed so that QRadar can
automatically import it?
A. /store/imports/inbound
B. /store/backupHost/inbound
C. /storetmp/backups
D. /storetmp/imports/backups
Answer: B
13.How many default dashboards are available in Qradar?
A. 6
B. 7
C. 5
D. 4
Answer: C
14.Which direction value means that an undefined local Source IP accesses an external resource?
A. R2L
B. L2R
C. L2L
D. R2R
Answer: D
15.QRadar uses rules to monitor the events and flows in your network to detect security threats.
When the events and flows meet the test criteria that is defined in the rules, an offense is created to
show that a security attack or policy breach is suspected. Knowing that an offense occurred is only
the first step; identifying the root cause of the offense requires analysis.
These statements refer to what kind of Offense Management?
A. Offense indexing
B. Offense investigations
C. Offense retention
D. Offense actions
Answer: B
16.Before the creation of a new application instance with QRadar Assistant, with what entity must
every application be associated?
A. A tenant
B. An authorization token
C. A security profile
D. A user role
Answer: B
17.What are unknown events?
A. Both of the above
B. The event cannot be understood or parsed by Qradar
C. The event is collected and parsed, but cannot be mapped or categorized to a specific log source.
D. None of the above
Answer: C
18.Which of the following changes require standard deployment?
A. Adding or editing a new user or user role.
B. Changing a users' role or security profile.
C. Configuring offsite hosts for sending or receiving data from the QRadar Console.
D. Restoring a configuration backup.
Answer: AB
19.Which of these views is provided by the DSM Editor?
A. Event Mappings tab, Flow tab, Protocols
B. Workspace, Event Mappings tab, Configuration tab
C. Dashboard, Event properties, Configuration tab
D. Workspace, Flow tab, Event properties
Answer: A
20.Which statement about IBM-validated QRadar content extensions is true?
A. They can be downloaded from IBM X-Force Fix Central.
B. They are hosted on the IBM X-Force Exchange portal.
C. They are restricted by the type of QRadar license that is acquired.
D. They are only downloaded from IBM approved third-party portals.
Answer: A
21.A QRadar deployment professional wants to integrate a dynamic data set like asset information so
that QRadar can use the latest information in the new data set to correlate the rules and alerts.
How can the deployment professional achieve this?
A. Use the UCM app.
B. Import the dynamic data in the reference set and use these reference sets in rules and building
blocks.
C. Use the Threat Intelligence app.
D. Use the QRadar Search to search each item in the list of imported data set.
Answer: D
22.In a multidomain and multitenant environment, how is event visibility provided to users?
A. An event is in a domain, a domain is attached to a tenant, and a tenant is referenced in the security
profile of the user.
B. An event is allocated to a tenant, a tenant is attached to a domain, and a domain is referenced in
the security profile of the user.
C. An event is allocated to a tenant, and a tenant is referenced in the security profile of the user.
D. An event is in a domain, and a domain is referenced in the security profile of the user.
Answer: A
23.What is correct permissions of directories in /store/ariel/events/payloads and
/store/ariel/flows/payloads?
A. 765
B. 755
C. 777
D. 754
Answer: B
24.Which two (2) file formats are available for exporting offenses?
A. XML
B. CSV
C. PDF
D. TXT
E. XLSX
Answer: AB
25.A deployment professional needs to troubleshoot a QRadar application that is not working.
Which tool can be used to aid the troubleshooting of containers and container management on the
QRadar Console or App Host?
A. qapp_debug.sh
B. qdocker ps
C. q_trev.sh
D. recon
Answer: D
26.Which of these is a tenant administrator responsible for?
A. Configure Domain Management
B. Collaborate with the MSSP administrator
C. Access or change the configuration for other tenants
D. Create roles and security profiles for tenant administrators and users
Answer: B
27.Which of these is a valid CIDR length value to use when configuring the network hierarchy in
QRadar?
A. /16
B. /38
C. /124
D. /256
Answer: A
28.QRadar rules can utilize reference data to further correlate results.
Which term is a valid reference data type?
A. Reference table of sets
B. Reference map
C. Reference graph
D. Reference table of maps
Answer: B
