Exit C2150-612 IBM Security QRadar SIEM V7.2.6 Associate Analyst
Question 1 of 5
0% complete
Q1 Single choice

An event is happening regularly and frequently; each event indicates the same target username. There is a
rule configured to test for this event which has a rule action to create an offense indexed on the username.

What will QRadar do with the triggered rule assuming no offenses exist for the username and no offenses are closed during this time?

  • A

    Each matching event will be tagged with the Rule name, but only one Offense will be created.

  • B

    Each matching event will cause a new Offense to be created and will be tagged with the Rule name.

  • C

    Events will be tagged with the rule name as long as the Rule Response limiter is satisfied. Only one offense will be created.

  • D

    Each matching event will be tagged with the Rule name, and an Offense will be created if the event magnitude is greater than 6.

Previous Next