Discuss IBM C1000-156 Exam Topic 6 Question 39

When will events or flows stop contributing to an offense?

AWhen the offense becomes dormant

BWhen the offense becomes inactive

CAfter the offense is assigned to an analyst

DWhen you protect the offense

Suggested Answer: A

In IBM QRadar SIEM V7.5, events or flows stop contributing to an offense when the offense becomes dormant. Here's how it works:

Dormant Offense: An offense becomes dormant when there is no new activity contributing to it for a specified period. This indicates that the threat or incident has not had any further related events or flows.

Contribution Stoppage: Once an offense is marked as dormant, no additional events or flows are added to it, which helps in managing the offense lifecycle and resources within QRadar.

This behavior helps in distinguishing between active and inactive threats, allowing security analysts to focus on ongoing incidents.

Reference The QRadar SIEM administration and user guides provide detailed explanations of offense management, including the conditions under which offenses become dormant and how this affects event and flow contributions.

Get Premium C1000-156 Questions as Interactive Web-Based Practice Test or PDF Real Exam Format Detailed Explanations Instant Access Get Your Practice Test

26 comments · newest first

Temeka 1 month ago

D is interesting. Protection could halt contributions.

Delisa 1 month ago

C makes sense too. Analysts can stop the flow.

Jennifer 2 months ago

I prefer B. Inactive feels more accurate.

Twila 2 months ago

I think it's A. Dormant means no activity.

Fidelia 2 months ago

D sounds good. Protecting could halt the flow of events.

Dierdre 2 months ago

C could be right too. Once assigned, it might stop counting.

Nakita 2 months ago

I disagree, A makes sense. Dormant means it’s just sitting there.

Cordell 2 months ago

I think it's B. Inactive means no more activity.

Mitsue 3 months ago

D seems off. Protecting doesn’t stop the flow.

Alpha 3 months ago

C is interesting. Once assigned, it might stop contributing.

Katheryn 3 months ago

A makes sense too. Dormant means it’s not happening anymore.

Kiley 3 months ago

I think B is right. Inactive means no more activity.

Dorthy 3 months ago

C makes sense, but I’m not sure it’s the only answer.

Shawnda 4 months ago

I’m surprised this is even a question, seems obvious!

Eugene 5 months ago

Wait, what does "protect the offense" even mean?

Bulah 5 months ago

I disagree, it could be B too, when it becomes inactive.

Tracie 5 months ago

I think it's A, when the offense becomes dormant.

In 6 months ago

Protecting the offense doesn’t stop contributions, right?

Fabiola 6 months ago

I disagree, it’s C for sure! Analysts have to review everything.

Cortney 6 months ago

Wait, can offenses really just stop? Sounds odd.

Antonio 6 months ago

Definitely B! Inactive means no more contributions.

Helene 6 months ago

I think it's A or B.

Curt 6 months ago

Protecting the offense sounds like it could be relevant, but I’m not confident that D is the right choice.

Gabriele 7 months ago

I feel like C could be a trick answer since assigning it to an analyst doesn’t necessarily mean it stops contributing.

Theresia 7 months ago

I remember a practice question about offenses becoming inactive, so I’m leaning towards B.

Meaghan 7 months ago

I think the answer might be A, but I'm not entirely sure what "dormant" really means in this context.

IBM C1000-156 Exam - Topic 6 Question 39 Discussion