C2150-624 Analyst Practice Questions

A security analyst is tasked with configuring a rule in QRadar to detect multiple failed login attempts. What is the first step they should take?

• AA. Review existing rules
• BB. Define the action
• CC. Set the rule conditions
• DD. Create a new log source

During a routine analysis, an analyst notices an unusual spike in traffic from a specific internal IP. What should be their immediate action?

• AA. Ignore the traffic
• BB. Block the IP
• CC. Create a filter for the traffic
• DD. Investigate the source IP

QRadar is generating too many false positive alerts. What action should a security analyst take to reduce this issue?

• AA. Disable alerts entirely
• BB. Increase system resources
• CC. Randomize alert settings
• DD. Tune rules and thresholds