IBM Exam C1000-140 Topic 2 Question 32 Discussion

Actual exam question for IBM's C1000-140 exam

Question #: 32
Topic #: 2

[All C1000-140 Questions]

Which log source should be used to filter QRadar audit events?

AHealth Metrics-2

BSIM Audit-2

CAudit-log

DSIM-Audit-log

Show Suggested Answer

Suggested Answer: D

by Raymon at Apr 11, 2024, 09:23 PM

Limited Time Offer

25%

Off

Get Premium C1000-140 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Tasia

15 days ago

Nah, I doubt they'd put a completely irrelevant log source as an option. That would just be cruel.

upvoted 0 times

...

Yuriko

17 days ago

I don't know, I'm still not convinced. The 'Health Metrics-2' option seems a bit suspicious. Maybe that's a trick answer?

upvoted 0 times

...

Stephaine

18 days ago

Haha, yeah, the 'SIM-Audit-log' option is a dead giveaway. It's like they're practically begging us to choose that one.

upvoted 0 times

...

Jesusa

19 days ago

You guys are overthinking this. It's clearly SIM-Audit-log. The question literally has 'SIM Audit' in the answer choices!

upvoted 0 times

...

Loren

21 days ago

I disagree, I think the Audit-log would be the more appropriate choice. It seems like that would be the log source specifically for audit events.

upvoted 0 times

...

Evangelina

23 days ago

Hmm, this is a tricky one. I'm not too familiar with QRadar's log sources, but I think the audit events should be coming from the SIM Audit-2 log source.

upvoted 0 times

...