C2150-612 Braindumps | Which QRadar rule could detect…

Questions: 4

Which QRadar rule could detect a possible potential data loss?

A. Apply “Potential data loss” on event of flows which are detected by the local system and when any IP is part of any of the following XForce premium
Premium_Malware
B. Apply “Potential data loss” on flows which are detected by the local system and when at least 1000 flows are seen with the same Destination IP and different
source in 2 minutes
C. Apply “Potential data loss” on events which are detected by the local system and when the event category for the event is one of the following Authentication and
when any of Username are contained in any of Terminated_User
D. Apply “Potential data loss” on flows which are detected by the local system and when the source bytes is greater than 200000 and when at least 5 flows are seen
with the same Source IP, Destination Port Destination IP in 12 minutes

Answer: D

C2150-612 | A mapping of a username to a user’s manager…

Question: 1

A mapping of a username to a user’s manager can be stored in a Reference Table and output in a search or a report. Which mechanism could be used to do this?

A. Quick Search filters can select users based on their manager’s name.
B. Reference Table lookup values can be accessed in an advanced search.
C. Reference Table lookup values can be accessed as custom event properties.
D. Reference Table lookup values are automatically used whenever a saved search is run .

Answer: B