IBM C1000-156 Exam - Topic 2 Question 15 Discussion

Actual exam question for IBM's C1000-156 exam

Question #: 15
Topic #: 2

A ORadar administrator is trying to tune a rule so that it cannot send an email more than 10 times in a 24-hour period. Which method can be used to accomplish this goal?

AUsing a special rule test that limits the number of rule triggers

BUsing the 'response limiter'

CTuning the rule conditions to make it trigger fewer times

DUsing the 'execute custom action' rule response

Show Suggested Answer

Suggested Answer: B

To ensure that a rule in IBM QRadar SIEM V7.5 does not send an email more than 10 times in a 24-hour period, the 'response limiter' can be used. Here's how it works:

Response Limiter: This feature limits the number of times a rule action (such as sending an email) can be executed within a specified timeframe.

Configuration: Set the response limiter to a maximum of 10 actions in 24 hours.

Implementation: Apply the response limiter to the rule, ensuring that even if the rule conditions are met multiple times, the email will only be sent up to the specified limit.

Reference IBM QRadar SIEM documentation on rule management and tuning includes detailed instructions on using the response limiter to control the frequency of rule actions.

by Winifred at Sep 13, 2024, 12:37 PM

Limited Time Offer

25%

Off

Get Premium C1000-156 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Rickie

5 months ago

Not sure if B is the best choice, what if it conflicts with other rules?

upvoted 0 times

...

Nichelle

5 months ago

A is a good option, but B is more straightforward.

upvoted 0 times

...

Kiley

5 months ago

Wait, can you really limit emails like that? Sounds too good to be true.

upvoted 0 times

...

Isaac

6 months ago

I think C could work too, but not as effectively.

upvoted 0 times

...

Roslyn

6 months ago

Definitely B, the 'response limiter' is the way to go!

upvoted 0 times

...

Arlette

6 months ago

I vaguely recall something about custom actions, but I don’t think that’s what we need for limiting email frequency.

upvoted 0 times

...

Tracie

6 months ago

Tuning the rule conditions seems like it could work, but I feel like that wouldn’t directly limit the number of emails sent.

upvoted 0 times

...

Dawne

6 months ago

I think the 'response limiter' is definitely the right choice here; it sounds familiar from our practice questions.

upvoted 0 times

...

Justine

7 months ago

I remember something about limiting triggers, but I’m not sure if it was a special rule test or the response limiter.

upvoted 0 times

...

Anglea

7 months ago

I'm leaning towards the 'execute custom action' option. That seems like it would give me the most control over the email limiting process.

upvoted 0 times

...

Rueben

7 months ago

Tuning the rule conditions could work, but that might get tricky. I'd rather find a more straightforward solution if possible.

upvoted 0 times

...

Mireya

7 months ago

The 'special rule test' sounds promising, but I'm not familiar with how that works. I'll have to research that a bit more.

upvoted 0 times

...

Reena

7 months ago

Hmm, I'm not sure about this one. I'll need to review the rule options more carefully to figure out the best approach.

upvoted 0 times

...

Delbert

7 months ago

I think the 'response limiter' option is the way to go here. It should let me easily cap the number of emails sent per day.

upvoted 0 times

...

Vi

2 years ago

I'm just hoping the exam doesn't have any trick questions like 'What's the square root of a penguin?' That would really ruffle my feathers.

upvoted 0 times

...

Dudley

2 years ago

I'm going with the 'execute custom action' rule response. It's got a certain je ne sais quoi, you know?

upvoted 0 times

Louisa

1 year ago

I'm not sure, but using a special rule test that limits the number of rule triggers could also work.

upvoted 0 times

...

Weldon

1 year ago

I agree, tuning the rule conditions to make it trigger fewer times might be the best approach.

upvoted 0 times

...

Domitila

1 year ago

I think using the 'response limiter' would be more effective in this case.

upvoted 0 times

...

Mirta

2 years ago

I think both B) and C) could work, but I would go with C) because it seems more straightforward.

upvoted 0 times

...

Devora

2 years ago

I disagree, I believe the correct method is C) Tuning the rule conditions to make it trigger fewer times.

upvoted 0 times

...

Mee

2 years ago

Well, if you can tweak the rule conditions to trigger fewer times, that might just do the trick. Gotta love a simple solution!

upvoted 0 times

Jaclyn

1 year ago

User 4: I'm not sure, but I think tuning the conditions is the best option.

upvoted 0 times

...

Lilli

1 year ago

User 3: Using a special rule test could also work, right?

upvoted 0 times

...

Roxanne

2 years ago

Agreed, that seems like the simplest solution.

upvoted 0 times

...

Evangelina

2 years ago

I think tuning the rule conditions is the way to go.

upvoted 0 times

...

Wilson

2 years ago

Hmm, not so sure about the 'test that limits the number of rule triggers' - sounds a bit complicated for this use case.

upvoted 0 times

Evangelina

2 years ago

Agreed, let's give that a try.

upvoted 0 times

...

Antonio

2 years ago

Yeah, that seems like the simplest solution.

upvoted 0 times

...

Stephaine

2 years ago

I think we should go with option B) Using the 'response limiter'.

upvoted 0 times

...

Darrin

2 years ago

I think the answer is B) Using the 'response limiter'.

upvoted 0 times

...

Marquetta

2 years ago

I think the 'response limiter' option is the way to go. Nice and simple, right?

upvoted 0 times

Barbra

2 years ago

Yeah, it's a straightforward solution to limit the number of emails sent.

upvoted 0 times

...

Agustin

2 years ago

I agree, the 'response limiter' seems like the best option.

upvoted 0 times

...