MENU
After how much time will QRadar mark an Event offense dormant if no new events or flows occur?
Suggested Answer: B
Get Premium C1000-162 Questions
as Interactive Web-Based Practice Test or PDF
Real Exam Format
Detailed Explanations
Instant Access
Get Your Practice Test
QRadar will mark an Event offense as dormant if no new events or flows occur within 30 minutes. However, if QRadar did not process any events within 4 hours, this also triggers the offense to become dormant. Once dormant, the offense remains in this state for 5 days unless new events or flows are added.
33 comments · newest first
WI
William
11 months ago
Definitely not 5 minutes, that's way too short.
BR
Brent
11 months ago
Wait, really? 24 hours seems too long!
ER
Ernest
11 months ago
I thought it was 30 minutes, not 2 hours.
AN
Annice
11 months ago
Totally agree, I've seen it happen!
RA
Raul
12 months ago
It's 2 hours for dormant offenses.
AL
Alise
12 months ago
I thought it was 5 minutes, but that seems too short for an event to be marked dormant.
DO
Dottie
12 months ago
I’m torn between 24 hours and 2 hours; I know it’s one of those two, but I can’t recall which.
SA
Sabra
1 year ago
I remember practicing a question about event dormancy, and I feel like it was 30 minutes.
TI
Timothy
1 year ago
I think QRadar marks an event dormant after 2 hours, but I’m not completely sure.
RE
Renea
1 year ago
5 minutes? That seems way too fast for an event to be marked dormant. I'm going to rule that one out and go with the longer time period of 2 hours.
TI
Timothy
1 year ago
Hmm, I'm not totally confident on this one. I think it might be 30 minutes, but I'm not 100% certain.
PE
Pearlene
1 year ago
I'm pretty sure it's 2 hours, but I'll double-check the QRadar documentation just to be sure.
MI
Micaela
1 year ago
Okay, let me think this through. I know QRadar has a dormancy period for events, so I'm guessing it's either 2 hours or 24 hours. I'll eliminate the other options and go with C.
RE
Reita
1 year ago
I'm leaning towards C as well. An audit trail just seems like the most practical and valuable reason to log all incidents, rather than just filling out fields or creating a personal database.
YO
Yoko
1 year ago
I'm pretty confident the answer is C. The code increments aVar by 1 before printing the message, so with aVar = 9, the output should be 10 Hello World!
HO
Honey
2 years ago
I'm going with 24 hours. Anything less and QRadar would be marking events as dormant before I even finish my morning routine.
VI
Vi
2 years ago
Yeah, I agree. It gives enough time for new events to come in.
JO
Johnson
2 years ago
I think 24 hours is a safe bet.
SU
Suzan
2 years ago
Maybe it's 2 hours then, to strike a balance.
FR
Frederick
2 years ago
I agree with Chun, 24 hours seems excessive.
LA
Lashunda
2 years ago
C'mon, 30 minutes? That's barely enough time for me to grab a coffee. Gotta be 2 hours, at least.
MA
Marva
2 years ago
B) I think it's 24 hours. That seems like a long enough time for an offense to be marked as dormant.
PA
Pauline
2 years ago
A) Yeah, 30 minutes is way too short. 2 hours sounds more reasonable.
BR
Brandon
2 years ago
C) 24 hours
MA
Magnolia
2 years ago
A) 2 hours
CH
Chun
2 years ago
But wouldn't 24 hours be too long to wait?
SU
Suzan
2 years ago
I believe it's 30 minutes.
MA
Malcom
2 years ago
Haha, 5 minutes? That's way too short. QRadar needs at least a few hours to decide if an event is truly dormant.
YO
Yoko
2 years ago
I think it's 24 hours. That's the standard dormancy period for most security tools.
AL
Alesia
2 years ago
I'm not sure, but I think it's 24 hours as well. It seems like a reasonable timeframe.
TE
Teri
2 years ago
I believe it's 24 hours too. It gives enough time for any potential threats to be detected.
DE
Delpha
2 years ago
I think it's 24 hours. That's the standard dormancy period for most security tools.
CH
Chun
2 years ago
I think it's 24 hours.