C1000-156 Practice Questions

In IBM QRadar SIEM, routing rules determine how incoming events are processed before they are written to storage. A single routing rule can be configured with multiple actions. The combination of "Forward" and "Bypass Correlation" is valid. This configuration allows an event to be sent to an external destination (e.g., another SIEM or a data lake) while also being stored locally on QRadar for searching and reporting, but without being analyzed by the Custom Rules Engine (CRE). This is useful for managing system load or for events that are needed for archival but not for real-time threat detection.

A. Drop and Bypass Correlation: The "Drop" action immediately removes the event from the QRadar pipeline. Therefore, no further actions, such as bypassing correlation, can be performed on it.

B. Drop and Log Only: The "Drop" action prevents the event from being stored or processed. This directly contradicts the "Log Only" action, which requires the event to be written to disk.

D. Bypass Correlation and Log Only: "Bypass Correlation" and "Log Only" describe the same outcome: the event is written to storage but is not sent to the correlation engine. They are not two separate, combinable actions within a routing rule.

1. IBM QRadar SIEM Administration Guide (Version 7.5.0): In the chapter on "Events," the section "Routing rules" describes the available actions. It explicitly states, "You can select multiple actions for the rule. For example, you can select to forward the event and to bypass correlation." This confirms that forwarding and bypassing correlation is a supported combination. The guide also clarifies that a dropped event "is removed from the QRadar data pipeline," making it impossible to combine with any other action. (IBM Security QRadar SIEM Administration Guide, Version 7.5.0, Document number: SC27-9228-02, Chapter 6: Events, Section: Routing rules).

In IBM QRadar SIEM, system health events are processed by a specific, predefined rule to generate alerts and offenses for administrators. The default rule responsible for this function is explicitly named "System: Notification". This rule is designed to monitor a wide range of internal system events, such as service failures, license limit warnings, deployment issues, and performance threshold breaches. When one of these events occurs, this rule triggers to create a notification, which typically manifests as an offense on the "Offenses" tab, ensuring that system health issues are promptly brought to the attention of the security team.

B. System: Hardware and Software monitoring: This is a descriptive phrase for a category of monitoring, not the specific name of the default rule that generates system notification offenses in QRadar.

C. System: Software Notifications: This name is too specific. The primary system notification rule is more general, covering software, hardware, licensing, and performance issues, not just software-related events.

D. System: Hardware Notifications: This is also too specific. The default "System: Notification" rule encompasses a broader range of system health events beyond just hardware failures.

1. IBM QRadar SIEM Administration Guide (Version 7.5.0): In the section "System notifications," the documentation states, "System notifications are generated by the System: Notification rule. This rule monitors system health and generates notifications when system functions fail or exceed configured thresholds." (Source: IBM Documentation, QRadar SIEM 7.5.0, Administration Guide, Chapter: "System notifications").

2. IBM QRadar SIEM Core Functionality Guide: The guide details default rule sets, where "System: Notification" is listed as a key rule within the system monitoring rule group. It is responsible for creating offenses from system events that are sent to the SIEM for self-monitoring purposes. (Source: IBM Documentation, QRadar SIEM Core Functionality Guide, Section: "Default Rules").

The IBM QRadar event ingress component, typically an Event Collector, receives data using various protocols. The most common listener-based, or "push," protocols are Syslog, SNMP, and HTTP Receiver. Syslog is a standard for forwarding log messages. SNMP (Simple Network Management Protocol) is used to receive trap messages from network devices. The HTTP Receiver protocol allows QRadar to act as a web server, collecting events sent via HTTP/S POST requests, which is common for cloud services and custom applications. These three protocols represent a core set of methods by which external sources actively send event data to be received by QRadar.

A. SFTR HTTP Receiver, SNMP

"SFTR" is not a recognized protocol. This is likely a typographical error for SFTP, which is used by the "Log File" protocol, not as a standalone receiver.

C. Syslog, FTP Receiver, SNMP

QRadar does not have a protocol named "FTP Receiver." It uses the "Log File" protocol to actively pull files from a remote server using FTP, SFTP, or SCP.

D. Syslog, HTTP Receiver, JDBC

While JDBC is a valid protocol for data collection, it is a "pull" mechanism where QRadar actively queries a database, rather than a "push" mechanism where QRadar passively receives data like Syslog or SNMP traps. Option B is more consistent as it lists only push/listener protocols.

1. IBM Security QRadar Log Source Management Guide (Version 7.5.0): This official guide details the protocols available for log source configuration.

Syslog Protocol: "Use the Syslog protocol to receive events from network devices that support sending syslog events to a remote syslog daemon." (Chapter 2: Log source protocol configuration options, "Syslog protocol" section).

SNMP Protocols: "Use the SNMP protocols to configure QRadar to receive SNMP traps (v1, v2, or v3) from devices on your network that are configured to generate SNMP events." (Chapter 2: Log source protocol configuration options, "SNMPv1/SNMPv2/SNMPv3 protocol" sections).

HTTP Receiver Protocol: "Use the HTTP Receiver protocol to configure a log source to receive events by using HTTP or HTTPS." (Chapter 2: Log source protocol configuration options, "HTTP Receiver protocol" section).

JDBC Protocol: This guide describes the JDBC protocol as a method where QRadar connects to a database to "poll for and retrieve events," confirming its nature as a pull mechanism. (Chapter 2: Log source protocol configuration options, "JDBC protocol" section).

Log File Protocol: This guide explains that the Log File protocol is used to "retrieve event files from a remote host" using methods like FTP, SFTP, and SCP, confirming it is a pull mechanism and that "FTP Receiver" is not the correct terminology. (Chapter 2: Log source protocol configuration options, "Log File protocol" section).

In IBM QRadar SIEM, the Domain Management feature is designed to segregate data, typically for multi-tenant or segmented network environments. This segregation is achieved by assigning specific data-generating assets to a defined domain. The primary sources of data that QRadar processes are events and flows. Therefore, log sources, which generate event data, and flow collectors, which process and generate flow data, are the fundamental objects that can be assigned to a domain to ensure that all data they produce is tagged and isolated within that domain.

A. Users: Users are assigned to domains to control their data access permissions, but they are not a source of event or flow data.

B. Rules: Rules are logic constructs that operate on data within domains; they are not data sources that are assigned to a domain.

E. X-Force Integration Feed: The X-Force feed is a global source of threat intelligence data applied across the entire QRadar deployment, not a tenant-specific data source to be segregated by domain.

1. IBM QRadar SIEM Administration Guide (Version 7.5.0): In the section on "Domains," the guide explicitly lists the types of data that can be assigned to a domain. It states, "You can assign the following types of data to a domain: Log sources, Log source groups, Flow sources, Flow collectors, Scanners." This directly confirms that Log sources (D) and Flow collectors (C) are assignable. (IBM Security QRadar SIEM Administration Guide, Version 7.5.0, Chapter: "Domains", Section: "Domains").

2. IBM QRadar SIEM Core Functionality Guide (Version 7.5.0): This guide details the flow of data into QRadar. It describes how Event Collectors process logs from log sources and how QFlow Collectors process network packets into flow records. The Domain Management function then uses these defined sources as the basis for data segregation, reinforcing that log sources and flow collectors are the correct entities to assign to a domain. (IBM Security QRadar SIEM Core Functionality Guide, Version 7.5.0, Chapter: "QRadar SIEM components", Section: "Event and flow pipelines").

IBM QRadar automatically assigns a default schedule to new weekly reports. According to the product documentation, weekly reports are queued to run at 01:00 AM every Sunday. Administrators may alter this schedule, but if no change is made the first run occurs at that default day/time. Therefore, the only option that matches the documented default is Sunday 01:00 AM (Option A).

B. Monday 02:00 AM – QRadar’s default weekly schedule is 1 AM Sunday, not Monday 2 AM.

C. Sunday 02:00 AM – Correct day, but default time is 1 AM, not 2 AM.

D. Monday 01:00 AM – Both day and time differ from the documented default Sunday 01:00 AM.

1. IBM Security QRadar Administration Guide 7.4.3, “Scheduling reports,” p. 384, para 3: “Weekly reports are scheduled by default for 1:00 AM on Sunday.”

2. IBM Docs (Knowledge Center) for QRadar 7.5, topic “Create and schedule a report,” Section “Default schedules,” bullet 2: “Weekly – Sunday at 01:00.”

3. IBM Redbooks, “IBM Security QRadar SIEM Users Guide,” SG24-8174-00, Ch. 14 “Reporting,” p. 414: “The system sets Sunday 1 AM as the default execution time for weekly reports.”

When the rate of incoming events or flows exceeds the licensed Events Per Second (EPS) or Flows Per Minute (FPM) limit, IBM QRadar activates its burst handling mechanism. Instead of dropping the excess data immediately, it is placed into a temporary buffer or queue. QRadar continues to process data from the queue at the maximum licensed rate. This feature is designed to manage short-term spikes in data volume without data loss. A system notification is also generated to alert administrators that the license limit has been exceeded. If the high data rate persists and the queue fills to capacity, new events or flows will then be dropped.

A. Incremental Licensing is a specific license type that allows for temporary increases, but it does not remove the fundamental EPS and FPM limits.

B. QRadar generates a notification, but it does not stop processing. Stopping processing would lead to a critical loss of security visibility.

D. This statement is too general. While processing continues, it is constrained by the license limit, and this option omits the critical detail of data being queued.

1. IBM QRadar SIEM Documentation, "Administering QRadar", Section: "Event and flow license overage".

Reference: "When you exceed your licensed events per second (EPS) or flows per minute (FPM) limit, QRadar does not stop processing the data. The extra data is placed into a buffer, or queue, and a system notification is generated to alert you that you are over your license. The data in the buffer is processed when the data rate falls below your licensed limit." This directly supports the queuing mechanism described in the correct answer.

2. IBM Redbooks, "IBM Security QRadar SIEM Implementation" (SG24-8176-01), Chapter 2, Section 2.4.2 "Licensing".

Reference: "QRadar has a burst handling capability that allows events to be queued temporarily if the licensed EPS rate is exceeded for a short period. If the EPS rate is exceeded for a longer period, the queue can fill up, and events are dropped." This confirms that queuing is the primary response to exceeding the license limit.

3. IBM QRadar SIEM Documentation, "Troubleshooting System Notifications", Section: "Health metric: Average EPS rate (last 1 minute) has exceeded the licensed EPS rate".

Reference: "When the number of incoming events or flows exceeds the license limits, QRadar queues the extra events and flows to be processed later. A queue is used to handle data bursts that exceed the license." This document explains the system notification and explicitly mentions the queue for handling bursts.

To display saved search results as a graphical chart (e.g., bar, pie, time series) on a QRadar dashboard, the search query must contain a GROUP BY clause. If the search is not grouped, it can only be displayed as a list of results. The "Include in my Dashboard" option becomes available to create a chart-based dashboard item only when the search criteria include aggregation and grouping. While permission issues can also restrict dashboard modifications, the most direct and common reason related to the search criteria itself is the absence of a GROUP BY clause, which is a prerequisite for all graphical dashboard items.

B. The option is valid only for searches based on events.

This is incorrect. QRadar dashboards can display items based on both event data and flow data searches.

C. The option is valid only for searches based on flows.

This is incorrect. QRadar dashboards can display items based on both flow data and event data searches.

D. The user does not have sufficient permissions.

While lack of the "Dashboard" permission would prevent adding items, the question specifies an "administrator," who typically has full permissions. The more specific technical prerequisite related to the search's content is the GROUP BY clause for graphical items.

1. IBM QRadar SIEM User Guide (Version 7.5.0):

Section: "Saving search criteria"

Content: "To display the search results as a chart on the Dashboards tab, you must use a GROUP BY clause in your AQL query. If you do not use a GROUP BY clause, you can display the search results only in a table." This directly links the GROUP BY clause to the ability to create chart-based dashboard items, which is a primary function of the "Include in my Dashboard" feature.

2. IBM QRadar SIEM User Guide (Version 7.5.0):

Section: "Dashboard management"

Content: The guide details adding various items, including "Log Activity" and "Network Activity" items derived from saved searches. It implicitly and explicitly shows that graphical representations require aggregated data, for which GROUP BY is the standard mechanism in AQL. The unavailability of the option points to the search not meeting the criteria for a graphical representation.

IBM e-mail notification templates are XML fragments that contain a element (mail subject line) and one or more elements (body text). IBM guides state that when you tailor a template you insert or change your own wording, variables, or translations only in those two elements; other tags such as or are structural and normally left untouched. Therefore the two elements you edit to incorporate your customisations are and .

A. is optional and cosmetic; the actual message body resides in , making unnecessary for required customisation.

B. is a container tag; IBM documentation instructs you not to alter it directly—custom text goes in nested tags instead.

C. Duplicate of D’s correct pair but listed earlier; option numbering error—select the single correct occurrence only.

1. IBM QRadar SIEM 7.4.3 Administration Guide, “Customizing e-mail notification templates”, p. 259-260: “Edit the and elements to add your custom content.”

2. IBM Guardium 11.2 Installation & Administration Guide, ch. “Alert e-mail templates”, p. 172: “Replace the text enclosed by … and … .”

3. IBM Security Identity Manager 7.0 Administration Guide, §10.3 “Localizing e-mail messages”, p. 303: “Customization is performed in the and sections only.”

The "Set as Default" option is specifically designed to make a saved search the initial view that loads when a user opens the associated tab. When an administrator creates a search in the Log Activity tab and selects "Set as Default" upon saving, QRadar will automatically run that search and display its results every time the administrator opens the Log Activity tab. This overrides the default real-time streaming view, providing a customized initial perspective based on the saved search criteria.

B. Include in my Quick Searches: This option adds the saved search to a drop-down menu for convenient, one-click access, but it does not make it the default view upon opening the tab.

C. Include in my Dashboard: This option adds the search results as a widget to the user's personal dashboard, which is separate from the Log Activity tab's default behavior.

D. Share with Everyone: This option controls the visibility and permissions of the saved search, allowing other QRadar users to access and run it, but it does not set it as a default view.

1. IBM QRadar SIEM User Guide: In the section on saving search criteria, the documentation states: "Select the Set as Default check box to make this search the default search that is displayed when you open the Log Activity or Network Activity tab."

Source: IBM Documentation, QRadar SIEM 7.5.0, "Saving event search criteria", Page: N/A (Web Document), Section: "Procedure", Step 5.

2. IBM QRadar Core Functionality Courseware: Official training materials for QRadar administration detail the user interface features. The module on searching and reporting explains that setting a search as default is the method to change the initial data presented in the Log Activity or Network Activity tabs.

Source: IBM Security Learning Academy, "IBM QRadar SIEM Foundations" course, Module: "Investigating Offenses and Events", Topic: "Saving and Managing Searches".

IBM QRadar security content, which includes applications, content packs, and extensions, is distributed through two primary channels. The IBM Security App Exchange is the official web-based marketplace where administrators can browse and download content packages. Within the QRadar product itself, the QRadar Assistant App provides an integrated interface to connect to the QRadar Application Repository (which is populated by the App Exchange) to find, download, and install these same extensions directly onto the QRadar Console.

B. IBM Applications Database: This is not an official or recognized name for any IBM resource related to QRadar content distribution.

C. IBM Fix Central: This portal is used exclusively for downloading official software patches, interim fixes, and version upgrades for IBM products, not for optional security content like apps.

D. IBM App Central: This is an incorrect name. The official marketplace is named the IBM Security App Exchange.

1. IBM QRadar Documentation - Managing apps: "You can browse for and download apps from the IBM Security App Exchange (https://exchange.xforce.ibmcloud.com/hub). You can also use the QRadar Assistant app to manage your apps. The QRadar Assistant app is available on the IBM Security App Exchange." This confirms both the external portal (App Exchange) and the internal tool that connects to the repository.

2. IBM Security App Exchange - About Page: "The IBM Security App Exchange is a marketplace for the security community to create and share applications based on IBM Security technologies. You can download apps to get new security use cases and extend the value of your existing security products." This document establishes the purpose of the App Exchange as the primary source for QRadar apps. (Source: IBM Security App Exchange website, https://exchange.xforce.ibmcloud.com/hub/about)