IBM Guardium v11.x Admin study plan

Diagram the Guardium v11.x component model from memory: collector, aggregator, central manager, S-TAP, CAS, GIM agent, and the internal database, labeling which flows are inbound versus outbound on each port

List the pre-installation prerequisites for a collector appliance and for a software install, including time sync, DNS, disk sizing, and network placement relative to the database server

Walk through the GIM deployment sequence and explain how the agent lifecycle (install, upgrade, health check) is driven from the central manager

Compare an in-place upgrade path against a fresh install plus configuration import, and state which artifacts must be exported before either begins

Practice routine system administration tasks on a lab unit: service control, disk and partition monitoring, log rotation, and scheduled maintenance windows

Configure and verify a backup and restore routine for the unit's configuration and report definitions, then restore into a scratch environment to confirm the procedure works

Interpret the output of the health and diagnostics tooling well enough to distinguish a healthy unit from one with a failing internal component

Document the purge and archive retention settings that govern how long audit data stays queryable on a collector

Register a database as a data source on a collector and explain how the assigned inspection engine and default policy take effect at registration time

Deploy an S-TAP to a Linux database host and confirm the collector sees traffic, using connection and sniffer status output as evidence

Add a CAS-hosted data source and describe when CAS is the right choice versus a local S-TAP

Build a small data-source inventory table listing each source, its type, its inspection point, and its owning collector

Construct a policy with access rules, a logging rule, and a session-level rule, and predict which rule fires for a given statement before testing it

Attach the policy to a data source and prove enforcement by generating allowed and blocked traffic from a client

Explain rule ordering, continue versus stop behavior, and how severity and classification tags propagate to reports

Draft an exception-handling pattern so a known-good application account is not blocked during a false positive

Run the built-in audit reports most relevant to a compliance review and export one to a format suitable for an auditor

Build a custom report and a custom query against audit data, then schedule it for recurring delivery to a distribution list

Create an alert that fires on a defined threshold and route it to a receiver, then trigger it deliberately and confirm receipt

Map a short list of common compliance control statements to the specific report or query that evidences each one

Create roles and users, assign granular permissions, and verify least-privilege behavior by logging in as a restricted user and attempting a forbidden action

Integrate an LDAP directory and an SSO identity provider, then resolve group-to-role mapping so directory groups land on the right Guardium roles

Explain how TLS certificates are used between components and how to replace an expiring certificate without breaking connectivity

Describe the key management and encryption posture for stored audit data, including what is encrypted at rest and what depends on external key infrastructure

Configure a managed unit under a central manager and push a policy change from the center to the unit, confirming it took effect

Set up aggregation so a collector's audit data rolls up to an aggregator, and verify a report run at the aggregator returns data from the collector

Use the central manager to compare configuration across units and identify drift between two managed units

Work a troubleshooting scenario end to end: a data source showing no traffic, diagnosed from S-TAP status through collector logs to the fix

Take two full timed practice assessments and log every missed question by domain so weak areas are explicit rather than guessed

Re-drill the three domains with the lowest practice scores using targeted lab repetition rather than rereading

Review performance-tuning levers: report scheduling load, purge settings, index and query cost, and when to move reporting off a busy collector

Rehearse the operational tasks most likely to be tested as sequences, such as upgrade order and restore order, out loud without notes