The SOC team complained that they have can only see one Offense in the Offenses tab.
space of 10 minutes, but the analyst How can the analyst ensure only one email is sent in this circumstance?

• A. Disable Automated Offense Notification - by email, in Advanced System Settings.
• B. Configure the postfix mail server on the Console to suppress duplicate items
• C. Add a Response Limiter to the Rule, configured to execute only once every 30 minutes.
• D. Ensure that the Rule Action Limiter is configured the same way as the Rule Response Limiter.

When is the rating of an Offense magnitude re-evaluated?

• A. when new events are added to the Offens
• B. when the threat assessment changes
• C. when the number of vulnerabilities increases
• D. when a port is opened

An analyst wants to view information about repeated offenders and IP addresses that generate many attacks or are subject to many attacks.
What should the analyst choose from the navigation options in the Offense tab?

• A. By Event Category or By Event Source
• B. By Source IP or By Destination IP
• C. By Event or By Flows
• D. By Log Source IP or By Event Source

설명: (Fast2test 회원만 볼 수 있음)

An analyst wants to find all events where Process name includes reference to exe files. Which quick search will return the expected result?

• A. (Process name) AND /.*exe/
• B. "Process name" AND "*exe"
• C. /Process name/AND (/exe) )
• D. /Process name/ AND /.*exe/

An analyst investigates an Offense that will need more research to outline what has occurred. The analyst marks a 'Follow up' flag on the Offense.
What happens to the Offense after it is tagged with a 'Follow up' flag?

• A. Only the analyst issuing the follow up flag can now close the Offense.
• B. A flag icon is displayed for the Offense in the Offense view.
• C. Other analysts in QRadar get an email to look at the Offense.
• D. New events or flows will not be applied to the Offense.

설명: (Fast2test 회원만 볼 수 있음)