I85PREP
⌘ K
IBM Guardium v11.x Admin study materials
IBM Guardium v11.x Admin study resources

IBM Guardium v11.x Admin practice questions

One question at a time. Build your IBM Guardium v11.x Admin understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Architecture, Installation, and Upgrade

A Guardium administrator is planning a new v11.x deployment and needs to size the appliance for a high-volume audit environment. Which component of the Guardium architecture is responsible for capturing database traffic and normalizing it into audit records before sending it to the collector?

  1. The aggregator, which consolidates records from multiple collectors
  2. The S-TAP and the inspection engine on the database server Correct answer.
  3. The central manager, which distributes policy to all appliances
  4. The Guardium Installation Manager (GIM), which deploys S-TAP binaries

Explanation

The S-TAP agent intercepts database traffic on the database server and hands it to the inspection engine, which parses and normalizes the session into audit records. The collector then receives these records for storage and correlation. Aggregators and the central manager handle consolidation and management rather than traffic capture.

Question 2Architecture, Installation, and Upgrade

In a Guardium v11.x environment, which appliance role is responsible for storing collected audit data long-term and providing a consolidated view across multiple collectors?

  1. The collector
  2. The aggregator Correct answer.
  3. The GIM server
  4. The S-TAP

Explanation

An aggregator receives data from one or more collectors, consolidates it, and supports long-term storage and enterprise-wide reporting. Collectors gather data from S-TAPs in real time, while the GIM server only distributes software. Aggregation is the tier that provides the cross-collector consolidated view.

Question 3Architecture, Installation, and Upgrade

Which Guardium appliance role provides a single point of administration for distributing policies, managing user accounts, and coordinating communication across collectors and aggregators?

  1. The S-TAP
  2. The central manager Correct answer.
  3. The standalone collector
  4. The STAP controller

Explanation

The central manager is the management tier of a Guardium deployment, distributing configuration and policy to managed units and providing centralized administration. Collectors and aggregators register with it for coordinated management. S-TAPs and controllers are data-capture components, not administrative hubs.

Question 4Architecture, Installation, and Upgrade

An administrator needs to deploy a Guardium v11.x collector that will receive traffic from S-TAPs on database servers. Which statement correctly describes the relationship between the S-TAP and the collector?

  1. The S-TAP performs all policy evaluation and stores final audit records without any collector.
  2. The S-TAP sends captured traffic to the collector, which processes and stores the resulting audit records. Correct answer.
  3. The S-TAP queries the central manager for policy and sends raw packets to the aggregator for parsing.
  4. The S-TAP stores audit records locally and forwards them to the aggregator directly, bypassing the collector.

Explanation

In the standard Guardium architecture, S-TAPs capture database traffic and transmit it to a collector, which parses, evaluates policy, and stores the resulting audit records. S-TAPs do not send data directly to aggregators or central managers. The collector is the processing and storage tier for captured traffic.

Question 5Architecture, Installation, and Upgrade

Before installing a Guardium v11.x appliance, an administrator reviews hardware and platform requirements. Which statement best describes the supported deployment model for Guardium v11.x appliances?

  1. Guardium appliances can only be installed on physical IBM hardware and cannot be virtualized.
  2. Guardium appliances must run on Kubernetes clusters in all supported deployments.
  3. Guardium appliances can be deployed as virtual appliances on supported hypervisors or as physical appliances. Correct answer.
  4. Guardium appliances require a dedicated mainframe LPAR for the collector tier.

Explanation

Guardium v11.x supports both physical appliances and virtual appliance images on approved hypervisors, giving administrators flexibility in sizing and placement. Virtual deployment requires meeting the documented CPU, memory, and disk requirements. Mainframe LPARs and mandatory Kubernetes are not the standard appliance deployment model.

Question 6Architecture, Installation, and Upgrade

During a fresh Guardium v11.x appliance installation, the administrator must complete initial configuration. Which task is part of the initial appliance setup performed through the console or CLI?

  1. Compiling the S-TAP kernel module on the database server
  2. Creating application user accounts inside the monitored database
  3. Defining the database schema for the customer's application tables
  4. Configuring network settings such as IP address, hostname, and gateway Correct answer.

Explanation

Initial appliance configuration includes network parameters such as IP address, hostname, gateway, and DNS so the appliance can communicate on the network. Application schemas, database users, and S-TAP kernel modules belong to the monitored database environment, not the appliance setup. Network configuration is a prerequisite for registering the appliance with the central manager.

Question 7Architecture, Installation, and Upgrade

An administrator has installed a new collector and wants it managed by an existing central manager. What is the correct approach to establish this relationship in Guardium v11.x?

  1. Register the collector with the central manager so the central manager can manage and distribute configuration to it. Correct answer.
  2. Point the S-TAPs directly at the central manager so they bypass the collector.
  3. Manually copy policy files to the collector using an SFTP share each time a policy changes.
  4. Install the central manager software on the collector so it becomes a second central manager.

Explanation

Managed units such as collectors and aggregators register with a central manager, which then distributes policy, configuration, and software updates to them. Registration establishes the trust and communication channel. Manual file copying and bypassing the collector are not supported management approaches.

Question 8Architecture, Installation, and Upgrade

An administrator is preparing to upgrade a Guardium v11.x environment that includes a central manager, collectors, and aggregators. Which upgrade sequence is generally recommended?

  1. Upgrade all appliances simultaneously to minimize the maintenance window.
  2. Upgrade the central manager first, then the managed units such as collectors and aggregators. Correct answer.
  3. Upgrade the aggregators first, then the central manager, and leave collectors until last.
  4. Upgrade all collectors first, then the aggregators, and finally the central manager.

Explanation

The central manager is typically upgraded first so it can manage and push updates to the managed units in a coordinated way. Collectors and aggregators are upgraded afterward, following the documented compatibility matrix. Upgrading managed units before the central manager can create version mismatches that complicate management.

Question 9Architecture, Installation, and Upgrade

Before performing an upgrade of a Guardium v11.x appliance, which preparatory step is most important to protect the existing configuration and data?

  1. Taking a full backup of the appliance configuration and data Correct answer.
  2. Deleting old audit records to free disk space for the upgrade
  3. Disabling all S-TAPs permanently before starting the upgrade
  4. Removing the appliance from the central manager and never re-registering it

Explanation

A full backup of configuration and data allows recovery if the upgrade fails or produces unexpected results. Guardium provides backup and restore capabilities for this purpose. Deleting audit data or permanently disabling S-TAPs is destructive and not part of upgrade preparation.

Question 10Architecture, Installation, and Upgrade

An administrator wants to use the Guardium Installation Manager (GIM) to deploy S-TAP to a large number of database servers. Which statement describes the role of GIM in the Guardium architecture?

  1. GIM replaces the central manager for policy distribution.
  2. GIM stores the audit records generated by the inspection engine.
  3. GIM captures network traffic from the database server.
  4. GIM distributes and manages software packages such as S-TAP on managed hosts. Correct answer.

Explanation

GIM is the software distribution component that installs, upgrades, and manages agents such as S-TAP on registered database servers. It does not store audit data, replace the central manager, or capture traffic. Using GIM simplifies large-scale agent deployment and version management.

Question 11Architecture, Installation, and Upgrade

A Guardium v11.x environment uses an S-TAP controller. What is the primary function of the S-TAP controller in this architecture?

  1. It stores audit data on behalf of the collector.
  2. It performs the upgrade of the central manager.
  3. It provides the web-based reporting interface for auditors.
  4. It manages communication and configuration between S-TAPs and the collector. Correct answer.

Explanation

The S-TAP controller acts as an intermediary that manages S-TAP connections and configuration for a collector, reducing the load on the collector itself. It does not store audit data or provide reporting. Central manager upgrades are unrelated to the S-TAP controller.

Question 12Architecture, Installation, and Upgrade

An administrator is planning capacity for a collector that will receive traffic from many high-throughput databases. Which factor most directly affects the sizing of the collector appliance?

  1. The volume and rate of audit records generated by the monitored traffic Correct answer.
  2. The version of the S-TAP controller software
  3. The number of database schemas defined in the monitored databases
  4. The number of user accounts on the central manager

Explanation

Collector sizing depends primarily on the volume and rate of audit records it must process and store, which drives CPU, memory, and disk requirements. Schema counts, central manager user counts, and controller versions do not determine collector capacity. Accurate sizing prevents dropped records and storage exhaustion.

Question 13Architecture, Installation, and Upgrade

Which Guardium component evaluates access policies against captured database traffic and determines whether an audit record is generated or an alert is raised?

  1. The central manager's user authentication module
  2. The inspection engine on the database server Correct answer.
  3. The GIM server's package repository
  4. The aggregator's reporting engine

Explanation

The inspection engine, working with the S-TAP on the database server, parses traffic and applies policy rules to decide what to log, alert on, or block. The aggregator handles consolidation and reporting, while GIM and authentication modules serve different purposes. Policy evaluation at the inspection engine is central to Guardium's real-time monitoring.

Question 14Architecture, Installation, and Upgrade

An administrator needs to verify that a newly installed Guardium v11.x appliance is functioning before registering it with the central manager. Which check is most appropriate?

  1. Confirm that the S-TAP kernel module compiles on the database server.
  2. Confirm that the monitored database application passes its regression test suite.
  3. Confirm that the aggregator has purged all old audit records.
  4. Confirm the appliance boots, network settings are correct, and the web interface is reachable. Correct answer.

Explanation

A newly installed appliance should be validated for successful boot, correct network configuration, and reachable web interface before registration. These checks confirm the appliance is operational and can communicate with the central manager. Application tests and S-TAP compilation belong to the database server setup.

Question 15Architecture, Installation, and Upgrade

During an upgrade of a Guardium v11.x collector, the administrator must consider compatibility with the central manager. Which statement reflects the correct compatibility principle?

  1. The collector must always be at a newer version than the central manager.
  2. The collector version is irrelevant because the central manager pushes all processing logic.
  3. The collector can run any version as long as the S-TAP version matches the database server OS.
  4. The collector must be at a version supported by and compatible with the central manager managing it. Correct answer.

Explanation

Managed units must run a version that is compatible with the central manager that manages them, as defined by the supported version matrix. Running an unsupported combination can break policy distribution and management. The S-TAP version and central manager processing do not remove this requirement.

Question 16Architecture, Installation, and Upgrade

An administrator is designing a Guardium v11.x deployment for a large enterprise with multiple data centers. Which architectural approach best supports centralized management while distributing audit processing?

  1. Deploy a single collector for all data centers and route all S-TAP traffic to it.
  2. Deploy one central manager per database server to avoid network latency.
  3. Deploy collectors in each data center, managed by a central manager, with aggregators for consolidation. Correct answer.
  4. Deploy only aggregators and have S-TAPs send traffic directly to them.

Explanation

A distributed design places collectors near the monitored databases to handle local traffic, while a central manager provides unified administration and aggregators consolidate data for enterprise reporting. This reduces WAN traffic and single points of failure. Sending all traffic to one collector or deploying per-server central managers is inefficient and unsupported.

Question 17Architecture, Installation, and Upgrade

Which Guardium v11.x component is responsible for receiving audit records from collectors and making them available for enterprise-wide reporting and long-term retention?

  1. The inspection engine
  2. The GIM client
  3. The S-TAP
  4. The aggregator Correct answer.

Explanation

Aggregators receive data from collectors and support consolidated reporting and long-term retention across the enterprise. S-TAPs capture traffic, GIM clients receive software, and the inspection engine parses traffic. The aggregator is the consolidation and warehousing tier.

Question 18Architecture, Installation, and Upgrade

An administrator is preparing an upgrade and must decide whether to use an offline or online upgrade method for a Guardium v11.x appliance. Which consideration is most relevant when choosing the method?

  1. Whether the central manager has more than one administrator account
  2. Whether the monitored database uses a particular SQL dialect
  3. Whether the appliance can tolerate downtime during the upgrade window Correct answer.
  4. Whether the S-TAP controller has been assigned a hostname

Explanation

The choice between offline and online upgrade methods depends largely on whether the appliance can tolerate downtime and on the supported upgrade path for the current version. SQL dialect, controller hostnames, and administrator counts do not determine the upgrade method. Downtime tolerance and supported paths are the deciding factors.

Question 19Architecture, Installation, and Upgrade

After upgrading a Guardium v11.x appliance, an administrator notices that the collector is no longer receiving data from its S-TAPs. Which troubleshooting step is most appropriate first?

  1. Verify S-TAP connectivity and that the collector service is running and reachable. Correct answer.
  2. Replace the central manager with a new appliance.
  3. Reinstall the operating system on the collector appliance.
  4. Delete all audit records to reset the collector.

Explanation

When a collector stops receiving S-TAP data after an upgrade, the first step is to verify S-TAP connectivity and confirm the collector service is running and reachable on the expected ports. This isolates network, service, and agent issues before any drastic action. Reinstalling the OS or replacing the central manager is disproportionate and risky.

Question 20Architecture, Installation, and Upgrade

Which statement accurately describes how a Guardium v11.x central manager distributes policy to managed collectors?

  1. The administrator must log in to each collector and recreate the policy manually.
  2. Policies are stored only on the S-TAP and never on the collector.
  3. Policies defined on the central manager are distributed to registered managed units. Correct answer.
  4. Policies are distributed only through the GIM package repository.

Explanation

The central manager is the authoritative source for policy definitions and distributes them to registered managed units such as collectors. This ensures consistent policy enforcement across the environment. Manual recreation on each collector, GIM-only distribution, and S-TAP-only storage are incorrect.

Question 21Architecture, Installation, and Upgrade

An administrator is evaluating whether to deploy a standalone collector or a collector managed by a central manager. Which advantage does a centrally managed collector provide?

  1. It removes the need for any S-TAP agents on the database servers.
  2. It eliminates the need for backups of the collector.
  3. It allows centralized policy and configuration management across multiple appliances. Correct answer.
  4. It guarantees unlimited storage capacity on the collector.

Explanation

A centrally managed collector benefits from centralized policy and configuration distribution, consistent administration, and coordinated upgrades. It still requires S-TAPs, finite storage, and regular backups. Central management improves operational consistency rather than removing fundamental requirements.

Question 22Architecture, Installation, and Upgrade

During a Guardium v11.x installation, the administrator must decide where to place the S-TAP controller. Which placement consideration is most accurate?

  1. The controller must be installed on the central manager appliance.
  2. The controller must be installed on the same host as the monitored database.
  3. The controller should be placed to efficiently manage S-TAP connections for its associated collector. Correct answer.
  4. The controller replaces the collector for data storage.

Explanation

The S-TAP controller is positioned to manage S-TAP connections and configuration efficiently for its associated collector, often reducing collector load. It is not required to reside on the database host or the central manager, and it does not replace the collector for storage. Placement should follow documented architecture guidance.

Question 23Architecture, Installation, and Upgrade

An administrator wants to confirm that a Guardium v11.x upgrade completed successfully. Which verification is most meaningful?

  1. Confirm the appliance version, services status, and that data collection and reporting continue to work. Correct answer.
  2. Confirm that all S-TAPs were uninstalled during the upgrade.
  3. Confirm that the central manager was removed from the environment.
  4. Confirm that the database server's operating system was also upgraded.

Explanation

Post-upgrade verification should confirm the appliance reports the expected version, required services are running, and data collection and reporting function normally. Database OS upgrades, S-TAP removal, and central manager removal are unrelated or destructive. Functional verification ensures the upgrade did not break core operations.

Question 24Architecture, Installation, and Upgrade

A Guardium v11.x deployment must support both real-time alerting and long-term forensic reporting. Which architectural combination best satisfies both requirements?

  1. Collectors for real-time processing and aggregators for consolidated long-term reporting Correct answer.
  2. Only a central manager, because it performs all processing and storage
  3. Only S-TAPs, because they store all audit records locally
  4. Only GIM servers, because they distribute reporting packages

Explanation

Collectors process traffic in real time and can raise alerts, while aggregators consolidate data for long-term forensic reporting across the enterprise. Relying on a single tier cannot satisfy both needs efficiently. S-TAPs and GIM servers do not provide storage or reporting for this purpose.

Question 25System Administration and Maintenance

Which Guardium component is responsible for capturing database traffic on a monitored database server and forwarding it to the collector?

  1. The central manager
  2. The aggregation appliance
  3. The Guardium web console
  4. The S-TAP agent Correct answer.

Explanation

The S-TAP is the software agent installed on or near the database server that intercepts traffic and streams it to the collector appliance. The central manager only coordinates configuration and reporting, and the web console is just the user interface.

Question 26System Administration and Maintenance

In a Guardium deployment, what is the primary role of the collector appliance?

  1. It receives and stores audit data from S-TAPs and performs real-time policy analysis. Correct answer.
  2. It stores the consolidated enterprise-wide report repository for all collectors.
  3. It acts as the LDAP bridge for authenticating database users.
  4. It provides the graphical dashboard used to define S-TAP installation parameters.

Explanation

A collector is the appliance that S-TAPs report to; it parses session data, applies inspection policies in real time, and stores the resulting audit records. Aggregation and enterprise reporting are handled by separate aggregation or central manager tiers.

Question 27System Administration and Maintenance

An administrator wants Guardium to automatically discover new database servers on the network without manually installing S-TAPs first. Which feature supports this?

  1. Audit process builder
  2. Value change tracking
  3. Snapshot reports
  4. S-TAP auto-discovery (GIM-based discovery) Correct answer.

Explanation

Guardium's auto-discovery uses the Guardium Installation Manager to scan subnets and identify database servers, after which S-TAPs can be deployed. Snapshot reports, the audit process builder, and value change tracking are unrelated reporting or configuration tools.

Question 28System Administration and Maintenance

Which Guardium user role has full authority over all appliances and system configuration?

  1. User
  2. Admin Correct answer.
  3. Auditor
  4. Operator

Explanation

The Admin role grants full privileges including appliance configuration, user management, and policy administration. Lower roles such as User, Operator, and Auditor have narrower, task-specific permissions.

Question 29System Administration and Maintenance

What is the purpose of the Guardium Installation Manager (GIM)?

  1. It centrally deploys, upgrades, and manages S-TAP and other client software. Correct answer.
  2. It generates compliance reports for auditors.
  3. It archives audit data to a remote storage location.
  4. It aggregates audit data from multiple collectors into one repository.

Explanation

GIM is the centralized mechanism for distributing and upgrading client modules such as S-TAPs across monitored servers. Data aggregation, archiving, and reporting are handled by other Guardium functions.

Question 30System Administration and Maintenance

Which Guardium feature allows an administrator to define what data is captured and stored, reducing storage by excluding irrelevant traffic?

  1. Inspection policies with rules that ignore or log only selected sessions Correct answer.
  2. The report builder
  3. The purge process
  4. The datasource definition

Explanation

Inspection policies determine which sessions are logged, ignored, or flagged, so excluding irrelevant traffic at the policy level reduces stored audit volume. Purge removes data after the fact, and report/datasource tools do not control capture.

Question 31System Administration and Maintenance

Which appliance type in a large Guardium environment consolidates data from multiple collectors for enterprise-wide reporting?

  1. Aggregation appliance Correct answer.
  2. Collector appliance
  3. S-TAP gateway
  4. Standby central manager

Explanation

An aggregation appliance receives data from multiple collectors and merges it so enterprise reports can span the whole environment. Collectors capture locally, and standby units provide failover rather than consolidation.

Question 32System Administration and Maintenance

Which Guardium process on an appliance is responsible for removing audit data older than the configured retention period?

  1. The import process
  2. The purge process Correct answer.
  3. The archive process
  4. The extraction process

Explanation

The purge process deletes audit data that has exceeded the retention window, freeing space on the appliance. Archiving moves data elsewhere for long-term storage, while import and extraction move data in other directions.

Question 33System Administration and Maintenance

An administrator needs to verify that a newly installed S-TAP is communicating with its collector. Which Guardium view should be checked first?

  1. The S-TAP status or S-TAP events view in the web console Correct answer.
  2. The value change tracking report
  3. The datasource group definition
  4. The compliance workflow status report

Explanation

The S-TAP status and event views show whether each S-TAP is connected and reporting to its collector, making them the first place to confirm connectivity. The other options relate to change monitoring, workflow, and grouping rather than agent health.

Question 34System Administration and Maintenance

A collector is running low on disk space because audit data is accumulating faster than expected. Which two actions best address this without losing required audit records?

  1. Delete the collector and reinstall it with a larger disk
  2. Tune inspection policies to reduce unnecessary logging and configure archiving to external storage Correct answer.
  3. Disable the purge process and increase the retention period
  4. Turn off all S-TAPs on the busiest database servers

Explanation

Reducing capture of irrelevant traffic through policy tuning and moving older data off the appliance via archiving both relieve disk pressure while preserving needed records. The other options either destroy data or stop auditing entirely.

Question 35System Administration and Maintenance

Which Guardium object must be defined so that a collector knows which database server address and port to monitor?

  1. A report definition
  2. A user role
  3. A datasource definition Correct answer.
  4. A query rewrite rule

Explanation

A datasource definition records the database server's address, port, type, and related connection details so Guardium can associate captured traffic with that database. Reports, roles, and query rewrite rules serve unrelated purposes.

Question 36System Administration and Maintenance

An administrator wants a specific group of database users to be flagged whenever they access a sensitive table outside business hours. Which Guardium capability is designed for this?

  1. A snapshot report comparing configuration over time
  2. A value change tracking alert on the table
  3. An inspection policy rule combining a user group, an object group, and a time-based condition Correct answer.
  4. A purge schedule for the affected database

Explanation

Inspection policy rules can combine user groups, object groups, and time conditions to flag or log matching activity in real time. Snapshot reports, value change tracking, and purge schedules do not evaluate access conditions at capture time.

Question 37System Administration and Maintenance

What is the recommended purpose of a central manager in a multi-appliance Guardium environment?

  1. To capture database traffic for all databases in the environment
  2. To centrally manage configuration, distribute policies, and provide consolidated reporting across appliances Correct answer.
  3. To store all raw audit data for the entire enterprise
  4. To replace the need for collectors in small environments

Explanation

The central manager is the management and reporting hub that pushes configuration and policies to managed units and provides a unified console. It does not capture traffic or store all raw audit data itself.

Question 38System Administration and Maintenance

An administrator wants to back up the Guardium appliance configuration so it can be restored after a failure. Which capability should be used?

  1. The S-TAP auto-discovery scan
  2. The audit data export to CSV
  3. The system backup and restore function Correct answer.
  4. The report scheduling feature

Explanation

Guardium provides a system backup and restore capability that captures appliance configuration and related data for recovery. Exporting reports, scheduling reports, and discovery scans do not produce a restorable system image.

Question 39System Administration and Maintenance

Which setting controls how long audit data remains on a collector before the purge process removes it?

  1. The report aggregation level
  2. The S-TAP heartbeat interval
  3. The inspection policy action
  4. The data retention period Correct answer.

Explanation

The retention period defines how long audit records are kept on the appliance before purge deletes them. Policy actions, heartbeat intervals, and aggregation levels do not govern retention duration.

Question 40System Administration and Maintenance

An administrator must give an auditor read-only access to compliance reports without allowing configuration changes. Which approach is most appropriate?

  1. Disable authentication on the appliance
  2. Assign the Auditor role to the user Correct answer.
  3. Assign the Admin role to the user
  4. Share the admin password with the auditor

Explanation

The Auditor role is designed to grant report and review access while preventing configuration changes, following least privilege. Admin access, shared credentials, and disabled authentication all violate security best practice.

Question 41System Administration and Maintenance

A new S-TAP is installed but no data appears in reports. The S-TAP shows connected, yet the collector receives no sessions. What is the most likely configuration issue to check first?

  1. Whether the purge process is scheduled
  2. Whether the report was scheduled for email delivery
  3. Whether the datasource definition and inspection policy match the database being monitored Correct answer.
  4. Whether the auditor role has been assigned

Explanation

If the S-TAP is connected but no sessions appear, the collector may not associate traffic with a defined datasource or an inspection policy may be ignoring it. Purge, report scheduling, and role assignment do not prevent session capture.

Question 42System Administration and Maintenance

Which Guardium feature lets an administrator monitor changes to specific column values in a table, such as a salary field?

  1. The central manager policy distribution
  2. The purge process
  3. Value change tracking Correct answer.
  4. S-TAP auto-discovery

Explanation

Value change tracking watches designated columns and reports when their values change, which is useful for sensitive fields like salary. Discovery, purge, and policy distribution serve unrelated functions.

Question 43System Administration and Maintenance

An administrator wants to ensure that if the central manager fails, management functions remain available. Which configuration supports this?

  1. Deploy a standby central manager for high availability Correct answer.
  2. Disable the purge process on all collectors
  3. Add a second collector to each database server
  4. Increase the S-TAP heartbeat interval

Explanation

A standby central manager provides failover so management and reporting functions remain available if the primary fails. Additional collectors, heartbeat changes, and purge settings address other concerns.

Question 44System Administration and Maintenance

Which statement best describes the relationship between S-TAPs and collectors in a distributed Guardium deployment?

  1. S-TAPs store all audit records locally and never communicate with collectors.
  2. Collectors push inspection policies directly into the database engine.
  3. Each S-TAP forwards captured traffic to one or more designated collectors for analysis and storage. Correct answer.
  4. Each collector installs an S-TAP on itself to monitor its own internal database.

Explanation

S-TAPs capture traffic on monitored servers and send it to their assigned collectors, which analyze and store the resulting audit records. S-TAPs do not retain the authoritative audit store, and collectors do not inject policies into the database engine.

Question 45System Administration and Maintenance

An administrator needs to reduce the volume of data archived to external storage while keeping all sessions that touch sensitive objects. Which approach is most appropriate?

  1. Configure inspection policies to log sensitive-object sessions and ignore routine traffic, then archive the retained data Correct answer.
  2. Increase the S-TAP heartbeat interval
  3. Archive only data older than one day regardless of content
  4. Disable archiving entirely and rely on purge

Explanation

Policy-level filtering keeps sensitive sessions while discarding routine traffic, so the archived set is smaller yet still contains all required records. Disabling archiving, archiving indiscriminately by age, or changing heartbeat timing does not achieve selective retention.

Question 46System Administration and Maintenance

A collector reports that its S-TAP is intermittently disconnected. Which combination of factors should an administrator investigate to isolate the cause?

  1. The purge schedule and archive destination
  2. Network reachability between the database server and collector, firewall rules, and S-TAP heartbeat settings Correct answer.
  3. The value change tracking configuration and datasource groups
  4. The report scheduling frequency and auditor role assignments

Explanation

Intermittent S-TAP disconnects typically stem from network path issues, firewall filtering, or heartbeat/timeout mismatches between the agent and collector. Reporting, roles, purge, and value change tracking do not govern agent connectivity.

Question 47System Administration and Maintenance

An organization must prove that audit records were not altered after capture. Which Guardium capability supports tamper-evident verification of stored audit data?

  1. The purge process
  2. The built-in integrity verification of audit records using hash-based signing Correct answer.
  3. The S-TAP auto-discovery scan
  4. The report builder

Explanation

Guardium signs audit records so their integrity can be verified, providing evidence that stored data was not modified after capture. Purge, reporting, and discovery do not provide tamper evidence.

Question 48System Administration and Maintenance

An administrator is planning capacity for a collector that will monitor several high-transaction databases. Which factor most directly drives collector storage sizing?

  1. The number of auditor user accounts
  2. The volume and type of traffic retained after inspection policy filtering Correct answer.
  3. The number of datasource groups defined
  4. The frequency of report scheduling

Explanation

Storage sizing depends primarily on how much session data survives policy filtering and how long it is retained. User accounts, report scheduling, and grouping do not materially change stored audit volume.

Question 49System Administration and Maintenance

During a policy deployment, an administrator wants changes tested on one collector before rolling them out to all managed units. Which approach best supports this?

  1. Disable the central manager during the change
  2. Apply the policy to all units simultaneously and monitor reports
  3. Assign the policy to the test collector first, validate results, then distribute to the remaining units Correct answer.
  4. Delete existing policies before creating the new one

Explanation

Staged rollout lets the administrator validate policy behavior on a single collector before enterprise-wide distribution, reducing risk. Simultaneous deployment, disabling the central manager, or deleting existing policies increases risk without validation.

Question 50System Administration and Maintenance

An administrator schedules a nightly Guardium archive job that exports collected audit data to a remote storage location. Which statement describes what happens to the archived data on the collector after a successful export?

  1. The exported audit data is moved into the collector's configuration backup area and restored with the appliance configuration.
  2. The exported audit data is compressed in place but never removed until the retention period expires through the purge task.
  3. The exported audit data is retained on the collector indefinitely and must be deleted manually by the administrator.
  4. The exported audit data is removed from the collector's internal database once the archive completes successfully, freeing space for new data. Correct answer.

Explanation

Guardium archiving is a data lifecycle mechanism: a successful export writes the records to the configured destination and then removes them from the appliance's internal audit store, which is why archiving is used to control collector disk growth. Purge handles retention-based deletion separately, and configuration backups cover appliance settings rather than audit records.