Exit C1000-026 IBM Security QRadar SIEM V7.3.2 Fundamental Administration
Question 5 of 5
0% complete
Q5 Single choice

An administrator has been tasked to create a saved search that shows a list of multiple login failures for a single user by username. The administrator has done the following:

1. Selected Last Hour in the view option.
2. In the Add filter window, selected the search parameter Custom Rule [Indexed].
3. Selected Equals for Operator.
4. Selected Authentication for Rule Group.

What is the next step the administrator needs to perform for the Rule option?

  • A

    Select login failures followed by success to the same username

  • B

    Select multiple login failures from the same source

  • C

    Select multiple login failures to the same destination

  • D

    Select multiple login failures for a single username

Previous Save & finish