IBM C1000-018 시험요강:
| 주제 | 소개 |
|---|
| 주제 1 | - Review the vulnerabilities and threat assessment of the hosts that are involved in the offense
- Navigate to, from and within an offense
|
| 주제 2 | - Extract information for regular or adhoc distribution to consumer of outputs
- Interpret rules that test for regular expressions
|
| 주제 3 | - Illustrate the difference between rule responses and rule actions
- Describe the use of the magnitude of an offense
|
| 주제 4 | - Review outputs in all available QRadar Tabs
- Illustrate the impact of QRadar property indexes
|
| 주제 5 | - Report any agents or log sources that are not reporting to QRadar on a regular basis
- Identify and escalate issues with regards to QRadar health and functionality
|
| 주제 6 | - Share findings about offenses by distributing offense detail via email
- Identify and escalate undesirable rule behavior to administrator
|
| 주제 7 | - Perform initial investigation of alerts and offenses created by QRadar
- Demonstrate how to export Flow
- Event data for external analysis
|
| 주제 8 | - Explain the different uses for each search type (ie., filtered, Quick and Advanced)
- Distinguish offenses from triggered rules
|
| 주제 9 | - Discuss the content of an event or flow, including the normalized fields
- Report any abnormal security access trends and events to security admins
|
| 주제 10 | - Review security risks and network vulnerabilities detected by QRadar
- Report rule usage and offenses generated by those rules
|
참조: https://www.ibm.com/training/certification/C0003502
IBM C1000-018 시험 개요:
| 인증 벤더: | IBM |
| 시험명: | IBM QRadar SIEM V7.3.2 기본 분석 |
| 시험 번호: | C1000-018 |
| 응시료: | USD 200 |
| 지원 언어: | 영어 |
| 시험 시간: | 90 minutes |
| 합격 점수: | 63 |
| 시험 형식: | 단일 선택형, 다중 선택형 |
| 실제 시험 문항 수: | 61 |
| 관련 자격증: | IBM QRadar SIEM V7.3.2 관리자 IBM QRadar SIEM V7.3.2 고급 포렌식 분석가 |
| 자격증 유효 기간: | 2년 |
| 샘플 문제: | IBM C1000-018 샘플 문제 |
| 응시 방법: | 현장 시험 (Pearson VUE) |
| 전제 조건: | 공식적인 선수 조건은 없으나, 기본적인 IT 보안 및 SIEM 개념에 대한 지식이 권장됩니다. |
| 공식 요강 URL: | https://www.ibm.com/certify/exam/c1000-018 |