Free C1000-162 sample questions

Correct answer: Review the full event payload of the login and extraction events to identify the exact SQL queries executed.

The most effective next step is to analyze the payload of the associated events. This will reveal the specific SQL queries run, which provides crucial context to differentiate between a routine backup/maintenance script (e.g., SELECT * FROM table_backup) and a malicious data exfiltration attempt (e.g., SELECT ssn, credit_card FROM customers). Escalating without this context is premature, reviewing past offenses is less direct, and checking asset profiles does not explain the specific action taken.

Correct answers: Utilize `GROUP BY destinationip` and `COUNT(sourceip)` to identify destinations contacted by many internal hosts.; Incorporate a `HAVING` clause with `SUM(bytes_sent)` to filter for destinations that received a total amount of data within a specific, anomalous range.

Grouping by the destination IP and then counting unique source IPs can quickly highlight a single external IP being contacted by many internal systems, a potential C2 server. This aggregation is computationally efficient.

The `HAVING` clause is used after `GROUP BY` to filter aggregated results. By summing the bytes sent to each destination and filtering for a total that is suspiciously large but spread out, the analyst can pinpoint slow exfiltration targets.

Correct answer: Using the 'right-click investigation' feature on the IP address to query the integrated Threat Intelligence feed.

The right-click investigation feature is designed for this exact purpose. It provides context-sensitive actions, including querying integrated threat intelligence feeds (like X-Force Exchange) for data on IPs, hashes, or URLs. This is the most direct and efficient method to check if an IP is associated with known malicious infrastructure like a botnet.

Correct answer: Enable the 'transactionID' property for indexing to improve search performance.

While creating the custom property is the first step, it is not searchable in quick filters or performant in AQL queries until it is enabled for indexing. Enabling indexing tells QRadar to specifically parse and store this property in the Ariel database for fast retrieval, which is essential for its effective use in rules, searches, and analysis.

Correct answer: False

This statement is false. Building Blocks are collections of reusable test conditions that, by themselves, do not create offenses or trigger responses. They are designed to be used as components within other rules to simplify complex logic and avoid redundancy. Only a Rule can trigger an offense or response.

Correct answer: An advanced search using an AQL query that filters flows where `GEO::LOOKUP(destinationip, 'country_code')` is in the reference set, grouped by `sourceip`.

To achieve this, the analyst must use an advanced search with AQL. The key is to use the `GEO::LOOKUP` function to enrich the flow data with geolocation information for the destination IP. This result is then filtered against the 'High-Risk Geo-Locations' reference set. Finally, grouping by `sourceip` allows the analyst to count and rank the internal hosts. This saved search can then be used as the basis for the report.

Correct answer: Create a reference set of 'On-Call Staff Accounts' and modify the rule to NOT trigger if the username is in this set.

The core problem is that the rule lacks the context to differentiate between truly dormant accounts and legitimately infrequent users. Creating a reference set of authorized infrequent users (like on-call staff) and adding a condition to the rule like 'and when the username is not contained in On-Call Staff Accounts reference set' is the most precise way to tune it. This directly addresses the source of the false positives without weakening the rule's ability to detect actual threats against other accounts.

Correct answers: A time series chart based on an AQL query that counts events grouped by log source.; An Offense Summary item, configured to display active offenses and using magnitude for color-coding.

A time series chart is the ideal way to visualize data over time. By using an AQL query that filters for events from critical servers (`...WHERE logsourceid IN (...)`) and groups them by time, the analyst can create the required real-time chart of event rates.

The Offense Summary dashboard item is specifically designed for this purpose. It can be configured to display active offenses and has built-in options to use the offense magnitude to set the background color, providing an immediate visual indicator of severity.

Correct answer: The events were identified as duplicates of a preceding event and were coalesced, but their details were preserved.

An event is marked as 'Stored' when QRadar's coalescing mechanism determines it is a duplicate of an event that occurred within a short time frame (e.g., multiple failed login attempts from the same source to the same destination). The system processes the first event fully and increments its event count, while subsequent identical events are 'stored' without being fully processed to save resources. This prevents rule chains from being flooded with redundant data but ensures the activity is recorded.

Correct answer: Select 'Last 24 Hours', then type 'malicious-domain.com' into the 'Payload Contains' filter.

The 'Payload Contains' quick filter performs a simple text search on the full, unparsed payload of every event. This is the most direct and efficient method for finding a specific string like a domain name, especially when you are unsure which specific parsed field (if any) might contain it. Combining this with the time range filter for 'Last 24 Hours' precisely meets the analyst's requirements.