IBM C1000-156 Exam - Topic 5 Question 36 Discussion

Actual exam question for IBM's C1000-156 exam

Question #: 36
Topic #: 5

[All C1000-156 Questions]

When creating an identity exclusion search, what time range do you select?

APrevious 7 days

BReal time (streaming)

CPrevious 30 days

DPrevious 5 minutes

Show Suggested Answer

Suggested Answer: B

When creating an identity exclusion search in IBM QRadar SIEM V7.5, the time range selected is 'Real time (streaming).' This setting ensures that the search continuously monitors and excludes identities in real-time as data is ingested. Here's the process:

Real-time Monitoring: Continuously updates the search results based on incoming data, providing immediate exclusion of specified identities.

Streaming Data: Processes data in a live stream, ensuring that the exclusion criteria are applied instantaneously as new events occur.

Reference The setup and configuration of identity exclusion searches are detailed in the QRadar SIEM administration guides, highlighting the importance of real-time streaming for effective identity management.

by Cyndy at Nov 19, 2025, 08:40 AM

Limited Time Offer

25%

Off

Get Premium C1000-156 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Argelia

5 days ago

B) Real time is crucial for urgent cases.

upvoted 0 times

...

Tandra

10 days ago

A) Previous 7 days balances detail and relevance.

upvoted 0 times

...

Shaquana

16 days ago

D) Previous 5 minutes seems too short.

upvoted 0 times

...

Sabra

21 days ago

I prefer B) Real time (streaming). Feels more accurate.

upvoted 0 times

...

Ula

26 days ago

I think A) Previous 7 days is best.

upvoted 0 times

...

Osvaldo

1 month ago

Not sure if A) is enough time for a good search.

upvoted 0 times

...

Thea

1 month ago

C) Previous 30 days is a solid choice too.

upvoted 0 times

...

Cyndy

1 month ago

Wait, D) Previous 5 minutes? That seems too short!

upvoted 0 times

...

Keva

2 months ago

B) Real time is the way to go for accuracy!

upvoted 0 times

...

Sophia

2 months ago

I usually go with A) Previous 7 days.

upvoted 0 times

...

Frederica

2 months ago

B) Real time (streaming) is the only way to truly stay ahead of the identity exclusion game.

upvoted 0 times

...

Sarina

3 months ago

A) Previous 7 days is a good balance between recency and coverage.

upvoted 0 times

...

Ira

3 months ago

C) Previous 30 days is the most comprehensive option.

upvoted 0 times

...

Layla

3 months ago

I feel like the previous 5 minutes is too short for an identity exclusion search, but I can't recall the exact reasoning.

upvoted 0 times

...

Melodie

3 months ago

I’m leaning towards the previous 7 days, but I could be mixing it up with another topic we covered.

upvoted 0 times

...

Tonette

3 months ago

I remember practicing a question like this, and I think real-time might be useful for urgent cases, but it feels risky.

upvoted 0 times

...

Shantell

3 months ago

I think the previous 30 days option makes the most sense, but I’m not entirely sure.

upvoted 0 times

...

Dawne

4 months ago

Hmm, I think the previous 5 minutes might be too narrow for an identity exclusion search. I'd lean more towards the previous 30 days to get a better understanding of the patterns and behaviors I'm trying to identify.

upvoted 0 times

...

King

4 months ago

For an identity exclusion search, I'd probably go with the previous 7 days. That seems like a good balance between recent activity and having enough data to analyze. But I'll double-check the details just to be sure.

upvoted 0 times

...

Tomoko

4 months ago

I'm a bit confused on this one. I know identity exclusion searches are important, but I'm not sure which time range would be the most appropriate. I'll have to review my notes and try to reason through the options.

upvoted 0 times

...

Barabara

4 months ago

B) Real time (streaming) is the way to go for identity exclusion.

upvoted 0 times

...

Tamie

4 months ago

D) Previous 5 minutes seems too short for an identity exclusion search.

upvoted 0 times

...

Lorita

5 months ago

C) Previous 30 days gives a broader view.

upvoted 0 times

...

Dorthy

5 months ago

I'd go with D) Previous 5 minutes - gotta stay on top of those identity exclusions, am I right?

upvoted 0 times

...

Casandra

5 months ago

Okay, let me see. I think the time range would depend on what I'm trying to identify in the identity exclusion search. Real-time streaming could be useful, but the previous 30 days might give me a better overall picture.

upvoted 0 times

...

Joni

5 months ago

Hmm, I'm not entirely sure about this one. I'll need to think it through carefully.

upvoted 0 times

Tomas

Real time seems more accurate for urgent cases.

upvoted 0 times

...

Wilda

4 months ago

I usually go with the previous 30 days.

upvoted 0 times

...