C1000-026 IBM Security QRadar SIEM V7.3.2 Fundamental Administration

Number of questions: 60
Number of questions to pass: 40
Time allowed: 90 mins
Status: Live

The test consists of 5 sections containing a total of approximately 60 multiple-choice questions. The percentages after each section title reflect the approximate distribution of the total question set across the sections.

Section 1: Implementing 8%
Plan and design QRadar deployment.
Implement and install QRadar.
Add Managed Hosts.

Section 2: Migrating and upgrading 12%
Plan QRadar upgrade and migration.
Review documentation and release notes.
Perform QRadar updates, patches and upgrades.
Perform migration (e.g., backup and restore, import and export content).

Section 3: Configuring and administering tasks 42%
Configure event flow sources and custom properties.
Maintain configuration and data backups.
Create and administer users, user roles, and security profiles.
Manage the license per allocation.
Create, review and modify rules, building blocks and reference sets.
Configure and manage retention policies (i.e., data and assets).
Create and manage saved searches, index, global views, dashboards and reports.
Deploy and manage applications and content packages.
Configure global system notifications.
Configure and apply network hierarchy.
Configure and manage domain and tenants.
Use the asset database.
Schedule and run a VA scan.

Section 4: Monitoring 25%
Monitor QRadar Notifications and error messages.
Review and interpret system monitoring dashboards.
Verify QRadar processes and services.
Monitor QRadar performance.
Use apps and tools for monitoring (e.g., QDI, assistant app, incident overview, DrQ).
Check system maintenance and health of appliances.
Monitor offenses and detect anomalies.

Section 5: Troubleshooting 13%
Demonstrate knowledge of key commands to interpret QRadar services and processes.
Explain error messages and notifications.
Interpret the basic logs (e.g., qradar.error, qradar.log).
Use embedded troubleshooting tools and scripts.

Overview
PartnerWorld Code: C0000801
Replaces PW Code: C0000800

Status: Live
This intermediate level certification targets analysts that have knowledge and technical skills in CompTIA Cybersecurity and IBM Security QRadar SIEM.

The CompTIA Cybersecurity Analyst (CySA+) certification verifies that successful candidates have the knowledge and skills required to configure and use threat detection tools, perform data analysis and interpret the results to identify vulnerabilities, threats and risks to an organization, with the end goal of securing and protecting applications and systems within an organization.

This IBM Security QRadar SIEM administrator certification verifies one can demonstrate the technical knowledge to support IBM Security QRadar SIEM V7.3.2, including implementation and management of an IBM Security QRadar SIEM V7.3.2 solution. Overall, these administrators are familiar with the product’s functionality and its security policies. They plan, install, configure, implement, deploy, migrate, upgrade, monitor and troubleshoot the IBM Security QRadar SIEM V7.3.2 software.

Recommended Prerequisite Skills
Test CS0-001, CompTIA CySa+ (CyberSecurity Analyst)
Network+, Security+ or equivalent knowledge. Minimum of 3-4 years of hands-on information security or related experience. While there is no required prerequisite, CySA+ is intended to follow CompTIA Security+ or equivalent experience and has a technical, hands-on focus.

Test C1000-026, IBM QRadar SIEM V7.3.2 Fundamental Administration

Basic knowledge of:
RedHat
Networking
Basic Query Language
Regular Expressions
System architecture design
Security platforms

Overview
PartnerWorld Code: C0003602
Replaces PW Code: 38008201

Status: Live
This entry level certification is intended for administrators who can demonstrate basic support and technical knowledge of IBM Security QRadar SIEM V7.3.2, including implementation and management of an IBM Security QRadar SIEM V7.3.2
solution.

Overall, these administrators are familiar with product functionality and the security policies. They plan, install, configure, implement, deploy, migrate, upgrade, monitor and troubleshoot the IBM Security QRadar SIEM V7.3.2 software.
Note: The function of specific apps, apart from the two bundled with the product, is out of scope, but the concept of extending the capability of using apps is in scope.
Recommended Prerequisite Skills

Basic knowledge in:
RedHat
Networking
Basic Query Language
Regular Expressions
System architecture design
Security platforms