I85PREP
⌘ K
IBM C1000-162 study materials
IBM C1000-162 study resources

IBM C1000-162 practice questions

One question at a time. Build your IBM C1000-162 understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Offense Analysis

In QRadar, which offense field indicates the rule or building block that generated the offense?

  1. The magnitude score
  2. The offense closing reason
  3. The assigned offense ID
  4. The offense type (for example, Source IP or Event Rule) Correct answer.

Explanation

Each offense carries a type that identifies the contributing mechanism, such as an event rule, a flow rule, or a source-IP-based condition. The offense ID is only an identifier, magnitude is a priority score, and the closing reason records why an analyst resolved it.

Question 2Offense Analysis

An analyst wants QRadar to automatically raise an offense when a single login failure count crosses a threshold within a short window. Which offense analysis concept does this describe?

  1. A custom flow property
  2. A report schedule
  3. A rule test with a time-based condition Correct answer.
  4. A network hierarchy edit

Explanation

Offense generation is driven by rule tests, which can include time-based conditions that count matching events within a defined interval. Flow properties, hierarchy edits, and report schedules do not themselves evaluate event thresholds to create offenses.

Question 3Offense Analysis

Which offense attribute is used to prioritize the analyst's queue based on the number of events, severity, and relevance?

  1. Close time
  2. Magnitude Correct answer.
  3. Offense ID
  4. Source IP

Explanation

Magnitude combines severity, relevance, and event volume into a single priority score used to rank offenses. Offense ID, source IP, and close time are descriptive attributes that do not express priority.

Question 4Offense Analysis

What is the purpose of the offense closing reason in QRadar offense analysis?

  1. To assign the offense to a different analyst automatically
  2. To document why an analyst resolved the offense for reporting and tuning Correct answer.
  3. To recalculate magnitude after each new event
  4. To convert the offense into a flow record

Explanation

Closing reasons capture the analyst's rationale, such as false positive or policy violation, and support later reporting and rule tuning. They do not transfer ownership, recompute magnitude, or transform the offense into a flow.

Question 5Offense Analysis

A source IP appears in many offenses across several days. Which offense analysis action helps an analyst reduce future noise from that address?

  1. Lower the global magnitude threshold
  2. Add the source IP to a reference set used by the rule Correct answer.
  3. Disable the event pipeline
  4. Delete the offenses from the system

Explanation

Reference sets can hold known-benign or watchlisted addresses that rules consult, allowing targeted suppression or escalation. Deleting offenses removes history, lowering the threshold affects all offenses, and disabling the pipeline stops collection entirely.

Question 6Offense Analysis

An offense lists multiple contributing rules. What does the offense's rule list represent?

  1. The rules that were disabled during the offense window
  2. The rules that generated the most reports
  3. The rules owned by the assigned analyst
  4. Each rule whose tests were satisfied by events associated with the offense Correct answer.

Explanation

The contributing rules list shows every rule whose tests matched and contributed events to the offense. It is not a record of disabled rules, analyst ownership, or reporting activity.

Question 7Offense Analysis

Which workflow step best supports collaboration when several analysts must review a high-severity offense?

  1. Assign the offense to an owner and add notes documenting findings Correct answer.
  2. Close the offense immediately to clear the queue
  3. Disable the associated rule permanently
  4. Change the offense ID to a memorable value

Explanation

Assignment establishes accountability, and notes preserve the investigation trail for other analysts. Closing prematurely loses analysis, offense IDs are system-assigned, and disabling rules is a tuning decision that should not be made casually.

Question 8Offense Analysis

An analyst notices an offense's magnitude increased after new events arrived. Which explanation is most consistent with QRadar behavior?

  1. The network hierarchy was exported
  2. The offense was reassigned to a new analyst
  3. The offense closing reason was edited
  4. Additional contributing events raised the offense's magnitude calculation Correct answer.

Explanation

Magnitude is recalculated as new events contribute to an offense, so additional matching events can raise the score. Reassignment, closing-reason edits, and hierarchy exports do not increase magnitude.

Question 9Offense Analysis

Which QRadar object stores a list of known malicious IP addresses that a rule can check when evaluating events?

  1. A saved search
  2. A dashboard
  3. A reference set Correct answer.
  4. A flow collector

Explanation

Reference sets hold reusable lists, such as malicious IPs, that rules and searches can reference during evaluation. Saved searches, dashboards, and flow collectors do not provide lookup lists for rule tests.

Question 10Offense Analysis

What does the offense source summary typically show for a network-based offense?

  1. The analyst's login history
  2. The appliance firmware version
  3. The rule author's name
  4. The contributing source IP addresses and their event counts Correct answer.

Explanation

The source summary aggregates the addresses that contributed events, often with counts, helping analysts identify the origin. Login history, rule authorship, and firmware versions are unrelated to offense sources.

Question 11Offense Analysis

An analyst needs to see the raw events that caused an offense. Which offense analysis action provides this?

  1. Change the offense's closing reason
  2. Drill down from the offense to its contributing events Correct answer.
  3. Reassign the offense to another analyst
  4. Export the offense list to CSV

Explanation

Offenses link to the events that contributed to them, allowing direct drill-down for validation. Exporting the list, reassigning, or changing a closing reason does not reveal the underlying event detail.

Question 12Offense Analysis

Which condition would most likely produce a false positive offense during a scheduled vulnerability scan?

  1. A rule that monitors DNS zone transfers
  2. A rule that alerts on many connection attempts from a single source Correct answer.
  3. A rule that tracks administrative logins
  4. A rule that alerts only on successful authentication

Explanation

Scanners generate many connection attempts, so rules keyed to high connection volume from one source commonly fire during scans. Rules limited to successful authentication, DNS zone transfers, or admin logins are less likely to trigger from routine scanning traffic.

Question 13Offense Analysis

What is the effect of tuning a rule to exclude a known scanner's address range?

  1. The rule is deleted from the system
  2. All offenses from the range are escalated
  3. Events from that range no longer satisfy the rule's tests Correct answer.
  4. The range is added to the network hierarchy as a new zone

Explanation

Excluding an address range in the rule logic prevents those events from matching, reducing noise while preserving the rule for other traffic. The rule is not deleted, offenses are not escalated, and the hierarchy is unchanged.

Question 14Offense Analysis

An offense shows a low magnitude but a high event count. Which interpretation is most reasonable?

  1. The contributing events have low severity or relevance despite high volume Correct answer.
  2. The offense was created without any events
  3. The magnitude field is corrupted
  4. The offense is guaranteed to be a critical incident

Explanation

Magnitude weighs severity and relevance along with volume, so many low-severity events can yield a modest score. High volume alone does not imply criticality, and an offense with a high event count clearly has contributing events.

Question 15Offense Analysis

Which action best supports an analyst who must document investigative steps taken on an offense for later audit?

  1. Change the offense magnitude manually
  2. Delete related events after review
  3. Rely on memory and close the offense
  4. Record findings in offense notes with timestamps Correct answer.

Explanation

Offense notes preserve a timestamped record of investigative steps, supporting audit and handoff. Memory is unreliable, manual magnitude changes are not documentation, and deleting events destroys evidence.

Question 16Offense Analysis

A rule uses a building block to encapsulate a common matching condition. What is the primary benefit of this design in offense analysis?

  1. Automatic closure of duplicate offenses
  2. Faster disk throughput on the collector
  3. Reuse of shared logic across multiple rules for consistent detection Correct answer.
  4. Reduction of the network hierarchy size

Explanation

Building blocks let shared conditions be defined once and reused across rules, keeping logic consistent and maintainable. They do not affect disk throughput, auto-close offenses, or shrink the hierarchy.

Question 17Offense Analysis

An offense's relevance value depends on which factor?

  1. The number of analysts currently logged in
  2. The color scheme of the dashboard
  3. The asset weight of the involved assets in the network hierarchy Correct answer.
  4. The size of the offense notes field

Explanation

Relevance reflects the importance of the assets involved, which is derived from asset weights configured in the network hierarchy. Login counts, note length, and dashboard styling do not affect relevance.

Question 18Offense Analysis

Which scenario most warrants escalating an offense to incident response rather than closing it as a false positive?

  1. A test system generated a single benign probe
  2. A rule fired on repeated failed logins followed by a successful login from an unusual geography Correct answer.
  3. A scanner triggered a connection-volume rule during a scheduled scan
  4. A known monitoring tool tripped a ping-based rule

Explanation

Repeated failures followed by a success from an unusual location suggests possible credential compromise and merits escalation. Scanner noise, monitoring pings, and benign test probes are typical false positives that can be tuned or closed.

Question 19Offense Analysis

An analyst wants to correlate offenses that share a common destination asset over time. Which approach is most appropriate?

  1. Change each offense's closing reason to the asset name
  2. Lower the global magnitude threshold
  3. Search offenses filtered by the destination IP and review the timeline Correct answer.
  4. Reassign all offenses to a single analyst

Explanation

Filtering offenses by the destination IP and reviewing their timeline reveals patterns tied to that asset. Renaming closing reasons, mass reassignment, and threshold changes do not establish correlation.

Question 20Offense Analysis

What does the offense's first occurrence and last occurrence timestamps represent?

  1. The time the rule was created and last edited
  2. The time the appliance booted and last restarted
  3. The time of the earliest and most recent events contributing to the offense Correct answer.
  4. The time the analyst opened and closed the offense

Explanation

First and last occurrence reflect the contributing events' timing, showing the offense's active span. They are not analyst action times, rule metadata, or appliance uptime markers.

Question 21Offense Analysis

A rule's test uses a threshold of 5 events in 10 minutes. What happens when only 3 matching events occur in that window?

  1. The threshold resets to zero automatically
  2. The test is not satisfied and no offense is generated by that test Correct answer.
  3. An offense is generated with reduced magnitude
  4. The events are discarded permanently

Explanation

A threshold test requires the specified count within the time window; falling short means the condition is unmet and no offense is produced by that test. Events are not discarded, thresholds do not auto-reset to zero as a rule behavior, and no reduced-magnitude offense is created.

Question 22Offense Analysis

Which offense analysis practice best reduces duplicate offenses for the same underlying activity?

  1. Consolidating related rules so a single offense captures the activity Correct answer.
  2. Creating a separate rule for every event type
  3. Increasing the number of collectors
  4. Disabling all correlation rules

Explanation

Consolidating related detections into coordinated rules reduces duplicate offenses for one activity. Proliferating rules increases duplicates, disabling correlation removes detection, and adding collectors increases data volume rather than deduplicating offenses.

Question 23Offense Analysis

What is the role of the offense's assigned analyst field?

  1. It sets the rule's threshold
  2. It records the user responsible for investigating and resolving the offense Correct answer.
  3. It defines the network hierarchy
  4. It determines the offense's magnitude

Explanation

Assignment records ownership so responsibility for investigation is clear. It does not influence magnitude, configure rule thresholds, or define the hierarchy.

Question 24Offense Analysis

An analyst observes an offense with no source IP listed. Which explanation is most plausible?

  1. The offense was generated by a rule whose contributing events lack a source IP field Correct answer.
  2. The analyst lacks read permission
  3. The magnitude was set to zero
  4. The offense was closed incorrectly

Explanation

Some offenses derive from event types or rules where a source IP is absent or not extracted, leaving the source summary empty. Incorrect closure, zero magnitude, and permissions do not remove source fields from an offense record.

Question 25Offense Analysis

Which QRadar capability allows an analyst to define reusable search criteria that can be referenced by rules?

  1. A flow interface
  2. A saved search used within rule logic Correct answer.
  3. A license key
  4. A routing rule

Explanation

Saved searches store reusable query criteria that can be referenced in rule logic for consistent detection. Flow interfaces, routing rules, and license keys serve unrelated functions.

Question 26Offense Analysis

In QRadar, an offense is created when a rule's test conditions are met and the rule's response actions include which action?

  1. Index an asset
  2. Seed an offense Correct answer.
  3. Deploy a change
  4. Reset a flow counter

Explanation

A rule generates an offense only when its response actions contain the "seed an offense" action, which creates or updates the offense record. Rules without that response action may still trigger notifications or other actions but will not produce an offense for analysts to triage.

Question 27Offense Analysis

Which offense attribute indicates how suspicious or important QRadar considers the offense based on contributing rules and asset weight?

  1. Relevance
  2. Severity
  3. Credibility
  4. Magnitude Correct answer.

Explanation

Magnitude is the computed score that reflects the significance of the offense, derived from the rules that contributed and the value of the assets involved. Analysts use magnitude to prioritize which offenses to investigate first.

Question 28Offense Analysis

An analyst opens an offense and wants to know which rule or rules fired to create it. Where does QRadar record this information on the offense?

  1. The contributing rules list Correct answer.
  2. The offense's notes tab
  3. The offense's magnitude history
  4. The offense's assigned analyst field

Explanation

Each offense lists the rules whose response actions seeded or contributed to it, so the analyst can trace why the offense exists. Reviewing that list is the standard way to understand detection logic behind an offense.

Question 29Offense Analysis

Which offense field tells an analyst the direction of the traffic that triggered a network offense, such as whether the source was internal or external?

  1. The offense's severity
  2. The offense's status
  3. The offense's direction attribute Correct answer.
  4. The offense's credibility

Explanation

The direction attribute (for example, inbound or outbound, or internal-to-external) summarizes the traffic flow associated with the offense. It helps the analyst quickly judge whether activity represents an external attack, data exfiltration, or internal movement.

Question 30Offense Analysis

During triage, an analyst wants to see all offenses that involve a particular username so they can determine whether the account is compromised. Which offense feature supports this?

  1. The offense's log source list
  2. The offense's event count
  3. The offense's username field with filtering Correct answer.
  4. The offense's magnitude chart

Explanation

Offenses carry a username attribute when the contributing events identify an account, and analysts can filter the offense list on that field. Filtering by username quickly groups related offenses for one identity across the deployment.

Question 31Offense Analysis

An analyst closes an offense as a false positive. What is the primary effect of that closure on future rule behavior?

  1. It records the analyst's judgment but does not itself tune the rule Correct answer.
  2. It deletes the underlying events from storage
  3. It automatically disables the rule that created the offense
  4. It lowers the offense's magnitude retroactively

Explanation

Closing an offense as a false positive documents the analyst's assessment and supports reporting, but it does not change the rule's logic. Actual tuning requires editing the rule or its building blocks so similar activity no longer triggers.

Question 32Offense Analysis

A high-severity offense is seeded by a rule that fires on a single failed login. Which observation most strongly suggests the offense should be tuned rather than escalated?

  1. The offense recurs for many users after routine password expirations Correct answer.
  2. The offense's source IP is an external address
  3. The offense's magnitude increased over the last hour
  4. The offense involves an administrative account

Explanation

A rule that fires on a single failure will generate noise whenever ordinary password changes cause failed logins, which is a classic tuning signal. Escalation is more appropriate when the activity suggests genuine attack behavior rather than routine user error.

Question 33Offense Analysis

An offense contains events from three different log sources but the analyst cannot determine which source contributed the triggering event. Which offense detail should the analyst review first?

  1. The offense's assigned analyst
  2. The offense's closure status
  3. The offense's event list sorted by time Correct answer.
  4. The offense's notes

Explanation

The offense's event list shows the individual events that contributed, and sorting by time reveals the earliest and triggering activity. That evidence lets the analyst identify which log source produced the event that matched the rule.

Question 34Offense Analysis

An analyst wants to determine whether an offense is part of a broader campaign by comparing it with other offenses from the same source IP. Which QRadar workflow is most appropriate?

  1. Export the offense to a report and close it
  2. Run an offense search filtered on the source IP and review the result list Correct answer.
  3. Reassign the offense to another analyst
  4. Open the offense's magnitude history and look for spikes

Explanation

Offense searches let analysts pivot from one offense to all offenses sharing an attribute such as source IP, which reveals patterns over time. Reviewing that list supports campaign-level analysis rather than single-offense triage.

Question 35Offense Analysis

An analyst sees an offense with a high magnitude but a low event count. Which interpretation is most consistent with QRadar scoring?

  1. The offense's events were deleted before review
  2. The offense is certainly a false positive
  3. The offense likely involves high-value assets or high-severity rules Correct answer.
  4. The rule is probably misconfigured and should be disabled

Explanation

Magnitude combines rule severity with asset weight, so a few events against critical assets or from a high-severity rule can produce a large score. Event count alone does not determine magnitude, so low volume does not imply low importance.

Question 36Offense Analysis

An analyst is reviewing an offense and wants to know whether the involved destination IP is a known production server with a business role. Which QRadar asset data provides this?

  1. The rule's test conditions
  2. The offense's severity value
  3. The offense's credibility score
  4. The asset profile for the destination IP Correct answer.

Explanation

Asset profiles store information such as business role, importance, and ownership for known IP addresses. Checking the profile tells the analyst whether the destination is a critical server, which informs prioritization and escalation.

Question 37Offense Analysis

An analyst wants to add a note to an offense documenting that the source IP was confirmed malicious via external intelligence. Which offense action accomplishes this?

  1. Adding an offense annotation or note Correct answer.
  2. Reassigning the offense to a queue
  3. Editing the offense's magnitude
  4. Changing the offense's status to closed

Explanation

Notes and annotations on an offense preserve analyst findings and evidence for later reviewers or audits. They do not alter detection logic or scoring and are the correct place for investigative documentation.

Question 38Offense Analysis

An offense's status is set to OPEN but no analyst has been assigned. Which statement best describes the operational implication?

  1. The offense's magnitude will continue to increase indefinitely
  2. The offense will be automatically closed after the next rule run
  3. The offense cannot be investigated until it is assigned
  4. The offense is available for any analyst to claim and investigate Correct answer.

Explanation

An unassigned open offense remains in the queue for any analyst with access to pick up and investigate. Assignment indicates ownership but is not a prerequisite for investigation.

Question 39Offense Analysis

An analyst notices the same rule seeding offenses repeatedly for a single noisy host. Which action best reduces future duplicate offenses without losing visibility of other hosts?

  1. Add a rule exception scoped to that host Correct answer.
  2. Disable the rule entirely
  3. Close each offense as it appears
  4. Lower the offense's magnitude manually

Explanation

A scoped exception suppresses the known noisy host while preserving detection for all other hosts. Disabling the rule entirely removes coverage and closing offenses repeatedly does not prevent recurrence.

Question 40Offense Analysis

An analyst must decide whether an offense involving outbound traffic to an unknown external IP is exfiltration or benign software update. Which evidence is most decisive?

  1. The offense's assigned analyst
  2. The number of contributing rules
  3. The volume and destination reputation of the outbound transfer Correct answer.
  4. The offense's severity value

Explanation

Distinguishing exfiltration from updates depends on evidence such as data volume, destination reputation, and timing relative to known patch cycles. Severity and rule counts indicate priority, not the nature of the traffic.

Question 41Offense Analysis

An analyst wants to review the sequence of actions taken on an offense by all analysts, including status changes and reassignments. Which offense element provides this?

  1. The offense's magnitude score
  2. The offense's activity or history log Correct answer.
  3. The offense's source summary
  4. The offense's event payload

Explanation

Offense history records workflow actions such as assignments, status changes, and annotations in chronological order. This supports handoffs and audits by showing who did what and when.

Question 42Offense Analysis

A rule seeds an offense on a destination port scan but the offense shows a source IP belonging to an internal vulnerability scanner. Which response best balances detection coverage and noise reduction?

  1. Raise the rule's severity to maximum
  2. Add the scanner's IP to the rule's exception or reference set Correct answer.
  3. Close the offense without documentation
  4. Delete all events from the scanner's IP

Explanation

Excluding the authorized scanner through an exception or reference set suppresses expected noise while keeping the rule active for unauthorized sources. Deleting events destroys evidence and raising severity increases noise.

Question 43Offense Analysis

An analyst observes an offense whose contributing rule list includes a building block rule. What does that indicate about the offense's detection logic?

  1. The building block directly seeded the offense as a standalone detection
  2. The building block supplied shared test logic used by the rule that seeded the offense Correct answer.
  3. The building block disabled the rule that created the offense
  4. The building block is a report template unrelated to detection

Explanation

Building blocks encapsulate reusable test conditions that other rules reference, so seeing one in the contributing list reflects shared logic rather than a standalone detection. They do not seed offenses on their own.

Question 44Offense Analysis

An offense's magnitude decreased between reviews even though no analyst changed anything. Which explanation is most consistent with QRadar behavior?

  1. The rule was automatically disabled by the system
  2. The offense was reassigned to another analyst
  3. New events were removed from the offense by the analyst
  4. The offense's contributing events aged out or the offense was re-evaluated Correct answer.

Explanation

Magnitude can change as contributing events age out of the retention window or as the offense is recalculated, since the score depends on the events currently associated. Reassignment and analyst actions do not directly reduce magnitude.

Question 45Offense Analysis

An analyst is asked to determine whether two offenses involving the same destination asset are related incidents or independent events. Which combination of evidence is most appropriate?

  1. Offense start times, source IPs, and contributing rules Correct answer.
  2. The assigned analyst names only
  3. Offense severity values only
  4. The offense IDs only

Explanation

Correlation requires comparing timing, origin, and detection logic to judge whether activity is a single incident or separate events. Severity, analyst names, and IDs alone do not establish a relationship.

Question 46Offense Analysis

An analyst wants to confirm that an offense's events were parsed correctly before drawing conclusions from field values. Which offense detail is most useful?

  1. The offense's magnitude trend
  2. The normalized event fields in the offense's event list Correct answer.
  3. The offense's assigned queue
  4. The offense's closure status

Explanation

Reviewing normalized fields in the event list shows whether QRadar extracted values such as source IP and username correctly. If parsing is wrong, conclusions drawn from those fields may be invalid.

Question 47Rules and Building Block Design

In QRadar, which building block stores reusable pattern-matching logic that can be referenced by multiple rules so the logic is maintained in one place?

  1. A log source extension
  2. A network hierarchy group
  3. A custom property expression
  4. A building block rule Correct answer.

Explanation

Building block rules contain no actions and no responses of their own; they exist to hold shared test logic that other rules reference from their rule test stack. Because the logic lives once, changing the building block updates every dependent rule.

Question 48Rules and Building Block Design

A rule author wants a rule to fire only when the same username fails authentication five times within ten minutes. Which QRadar mechanism provides this behavior?

  1. An offense annotation applied by an analyst
  2. A flow filter on the destination port
  3. A report that counts failed logins hourly
  4. A rule test using a time-based condition on a matched event count Correct answer.

Explanation

QRadar rules support time-based tests that count matching events for a specified interval and group them by a chosen field, which is exactly the threshold pattern requested. The count is evaluated as events stream in, so the rule fires on the fifth match inside the window.

Question 49Rules and Building Block Design

What is the primary purpose of an offense in QRadar rule design?

  1. To define which ports are scanned during discovery
  2. To represent a correlated security incident that analysts investigate and track Correct answer.
  3. To store the normalized form of every incoming event
  4. To hold the license entitlement for log sources

Explanation

Rules generate offenses when their tests and responses are satisfied, and the offense is the investigative container that aggregates contributing events and flows. Analysts assign, annotate, and close offenses as part of the workflow.

Question 50Rules and Building Block Design

Which statement correctly describes the difference between a rule and a building block within QRadar's rules engine?

  1. A rule cannot reference another rule, and a building block cannot be referenced at all
  2. A rule can carry responses such as offense creation, while a building block contains only tests Correct answer.
  3. A building block runs on flows only, while a rule runs on events only
  4. A building block can create offenses, while a rule only evaluates conditions

Explanation

Rules and building blocks share the same test framework, but only rules execute responses like generating an offense or sending an email. Building blocks are deliberately restricted to tests so they can be reused safely inside other rules.