{"EXAM_SERIES_CODE":"C1000-156","EXAM_STATUS_ID":"1","EXAM_REVIEW_APPROVAL_STATUS_OPS":null,"EXAM_REVIEW_APPROVAL_STATUS_OTHER":null,"EXAM_REVIEW_APPROVAL_STATUS_PUBLISH":null,"EXAM_TITLE":"IBM Security QRadar SIEM V7.5 Administration","WITHDRAWAL_DATE":null,"CREATED_BY_EMAIL":"briggsb@us.ibm.com","CREATED_BY_DATE":"2022-06-29 00:00:00.000000","OWNER_NAME":"Andrew C Mccarl","OWNER_EMAIL":"amccarl@us.ibm.com","LAST_MODIFIED_BY_EMAIL":"jessfern@us.ibm.com","LAST_MODIFIED_BY_DATE":"2025-07-14 00:00:00.000000","EXAM_BUSINESS":"IBM Security","EXAM_BRAND":"Threat Management","EXAM_REPLACED_FLAG":false,"REPLACE_BY_EXAM_SERIES_CODE":null,"PREREQUISITE_EXAM_SERIES_CODE":null,"OVERVIEW_JOB_ROLE":"<p>During exam development, the Subject Matter Experts (SMEs) define all of the tasks, knowledge and experience that an individual would need in order to successfully fulfill their role with the product or solution. These are represented by the objectives below and the questions on the exam are based upon these objectives.</p>","OVERVIEW_JOB_SKILL":null,"EXAM_TIME_LIMIT":90,"EXAM_PASSING_SCORE":61,"EXAM_NUMBER_OF_QUESTIONS":62,"EXAM_NUMBER_OF_QUESTIONS_TO_PASS":38,"EXAM_PRICE_DEVELOPED":null,"EXAM_PRICE_EMERGING":null,"EXAM_PRICE_JAPAN":null,"AVAILABLE_FOR_PROCTOR_FLAG":true,"WITHDRAWAL_WARNING_DAYS":30,"BADGE_REPLACED_FLAG":false,"REPLACE_BY_BADGE_ID":null,"EDUCATION_OVERVIEW":"<p>To prepare for the test, first reference the self-study course listed below.&nbsp; It is free-of-charge and covers all the knowledge and skills measured on the test.</p><p><strong>Note:</strong> &nbsp;</p><ul><li>Extensive hands-on product knowledge is required to pass the test.</li><li>These learning sources are recommended, but not required before taking this test.</li><li>You must be logged in to the Security Learning Academy for the link to the self-study course to work properly. If you see an error message after clicking a link, log in and retry the link.</li><li>Every effort has been made to make the recommended learning sources as complete and as accurate as possible, but no warranty of fitness is implied. The learning sources provided are on an 'as is' basis. IBM shall have neither liability nor responsibility to any person or entity with respect to any loss or damages arising from course or publication content.</li></ul><p><strong>Online Self-study Course</strong></p><p><a href=\"http://learn.ibm.com/course/view.php?id=14048\">Click here</a> to access the online course: QRadar SIEM V7.5 Administration - Exam C1000-156 Preparation Guide</p>","JTA_OBJECTIVE_UPLOAD_PATH":null,"JTA_SURVEY_FLAG":true,"JTA_JOB_ROLE_DESCRIPTION":"<p>This intermediate level certification is intended for professionals who wish to validate their comprehensive knowledge of IBM Security QRadar SIEM V7.5 Administration.</p><p>&nbsp;</p><p>These administrators will have knowledge and experience in the configuration, performance optimization, tuning, troubleshooting, and system administration for an IBM Security QRadar SIEM V7.5 on-premise deployment. This includes the apps installed with QRadar: Use Case Manager, QRadar Assistant, Log Source Manager, and Pulse, plus a basic understanding of: User Behavior Analytics, QRadar Deployment Intelligence, Reference Data Management. This does not include the SaaS offering QRadar on Cloud (QRoC).</p><p>&nbsp;</p><p><strong>Key Areas of Competency</strong></p><p>QRadar troubleshooting</p><p>Searching and reporting</p><p>Rules and building blocks</p><p>Understanding reference data</p><p>Basic QRadar tuning and network hierarchy</p><p>QRadar deployment and component architecture</p><p>Understanding QRadar Event and Flow pipelines</p><p>QRadar user management and data access control</p><p>Basic concepts of multi-domain</p><p>QRadar instances&nbsp;</p><p>&nbsp;</p><p><strong>Prerequisite Knowledge </strong>(not measured on the test)</p><p>Basic security technologies, SIEM concepts, TCP/IP networking, IT security concepts, and IT skills</p><p>Offense and log analysis</p><p>Enterprise logging</p><p>Network monitoring using flows</p><p>QRadar Network Insights, QRadar Incident Forensics</p>","BLUEPRINT_UPLOAD_PATH":null,"SURVEY_FROM_JTA_COUNT":21,"PLANNED_ASSESSMENT_EXAM_FLAG":true,"PLANNED_SAMPLE_QUESTIONS_FLAG":true,"NUMBER_OF_LIVE_FORMS":2,"NUMBER_OF_ITEMS_PER_FORM":61,"MINIMALLY_COMPETENT_CANDIDATE":"<p>This intermediate level certification is intended for professionals who wish to validate their comprehensive knowledge of IBM Security QRadar SIEM V7.5 Administration.</p><p>&nbsp;</p><p>These administrators will have knowledge and experience in the configuration, performance optimization, tuning, troubleshooting, and system administration for an IBM Security QRadar SIEM V7.5 on-premise deployment. This includes the apps installed with QRadar: Use Case Manager, QRadar Assistant, Log Source Manager, and Pulse, plus a basic understanding of: User Behavior Analytics, QRadar Deployment Intelligence, Reference Data Management. This does not include the SaaS offering QRadar on Cloud (QRoC).</p><p>&nbsp;</p><p><strong>Key Areas of Competency</strong></p><p>QRadar troubleshooting</p><p>Searching and reporting</p><p>Rules and building blocks</p><p>Understanding reference data</p><p>Basic QRadar tuning and network hierarchy</p><p>QRadar deployment and component architecture</p><p>Understanding QRadar Event and Flow pipelines</p><p>QRadar user management and data access control</p><p>Basic concepts of multi-domain</p><p>QRadar instances&nbsp;</p><p>&nbsp;</p><p><strong>Prerequisite Knowledge </strong>(not measured on the test)</p><p>Basic security technologies, SIEM concepts, TCP/IP networking, IT security concepts, and IT skills</p><p>Offense and log analysis</p><p>Enterprise logging</p><p>Network monitoring using flows</p><p>QRadar Network Insights, QRadar Incident Forensics</p>","ITEMTYPE_MULTIPLE_CHOICE":true,"ITEMTYPE_DOMC":false,"ITEMTYPE_BUILD_LIST":true,"ITEMTYPE_HOT_AREA":false,"ITEM_WRITING_TOOL_OTHER":null,"ITEM_WRITING_BEST_PRACTICE":true,"ITEM_WRITING_BEST_PRACTICE_OTHER":null,"ITEM_WRITING_TYPES":2,"ITEM_WRITING_GRAMMAR_CHECK_FLAG":true,"ITEM_WRITING_TECHNICAL_CHECK_FLAG":true,"PSYCHO_REVIEWED_ALL_FLAG":false,"PSYCHO_EVALUATE_TEN_PERCENT_FLAG":false,"PSYCHOMETRIC_REVIEWER_NAME":null,"PSYCHOMETRIC_REVIEWER_EMAIL":null,"STANDARDS_TWO_STEP_METHOD_FLAG":true,"STANDARDS_OTHER":null,"STANDARDS_OTHER_WHO":null,"STANDARDS_OTHER_DATE":null,"STANDARDS_OTHER_COMMENTS":null,"STANDARDS_SUPPORTING_FILES_UPLOAD_PATH":null,"CUTSCORE_RATING_FILE_UPLOAD_PATH":null,"FORMS_ASSESSMENT":true,"FORMS_SAMPLE_QUESTIONS":true,"FORMS_ITEMS_PER_FORM":62,"FORMS_ANCHOR_ITEMS_PER_FORM":13,"SAMPLE_EXAM_COS_KEY":null,"STUDY_GUIDE_COS_KEY":null,"TINSERTTS":"2022-06-29 20:02:12.220594","TLASTUPDTS":"2025-07-14 18:51:33.948915","FINANCE_BUSINESS_UNIT":"IBM Security","FINANCE_BRAND":"Not Applicable","EXAM_TYPE_ID":0,"DIVERSE_COUNTRY_BACKGROUND_FLAG":true,"EXAM_TYPE_DEVELOPING":"New version of an existing exam","STANDARDS_JOB_ROLE_DESC":"<p>This intermediate level certification is intended for professionals who wish to validate their comprehensive knowledge of IBM Security QRadar SIEM V7.5 Administration.</p><p>&nbsp;</p><p>These administrators will have knowledge and experience in the configuration, performance optimization, tuning, troubleshooting, and system administration for an IBM Security QRadar SIEM V7.5 on-premise deployment. This includes the apps installed with QRadar: Use Case Manager, QRadar Assistant, Log Source Manager, and Pulse, plus a basic understanding of: User Behavior Analytics, QRadar Deployment Intelligence, Reference Data Management. This does not include the SaaS offering QRadar on Cloud (QRoC).</p><p>&nbsp;</p><p><strong>Key Areas of Competency</strong></p><p>QRadar troubleshooting</p><p>Searching and reporting</p><p>Rules and building blocks</p><p>Understanding reference data</p><p>Basic QRadar tuning and network hierarchy</p><p>QRadar deployment and component architecture</p><p>Understanding QRadar Event and Flow pipelines</p><p>QRadar user management and data access control</p><p>Basic concepts of multi-domain</p><p>QRadar instances&nbsp;</p><p>&nbsp;</p><p><strong>Prerequisite Knowledge </strong>(not measured on the test)</p><p>Basic security technologies, SIEM concepts, TCP/IP networking, IT security concepts, and IT skills</p><p>Offense and log analysis</p><p>Enterprise logging</p><p>Network monitoring using flows</p><p>QRadar Network Insights, QRadar Incident Forensics</p>","ITEMTYPE_OTHER":false,"TARGET_PUBLICATION_DATE":"2022-11-11","PEARSONVUE_START_DATE":null,"ACTUAL_START_DATE":"2022-10-21 00:00:00.000000","FORMS_PSYCHOMETRICIAN_NAME":"Isaac Pfleger","FORMS_PSYCHOMETRICIAN_EMAIL":"isaac@cms.itemexperts.com","PEARSONVUE_SELECTION":"Publish according to business rules","ASSESSMENT_FLAG":true,"PARENT_FORMS":"Form A,Form B,Form C","GOVERNANCE_COMPLETED_FLAG":true,"WITHDRAWAL_REASON":null,"WITHDRAWAL_REASON_COMMENT":null,"PV_PUBLISH_DATE":"2022-10-21 14:19:48.737227","READY_FOR_LIVE_DATE":"2022-10-21 14:20:11.217145","UUID":"5aae71fd-9104-4561-a884-7c0c74915a56","GO_LIVE_DATE":"2022-10-21 15:32:06.579041","MKTGCATEGORY":"MBI01","EXAM_STATUS":"Live","MKTGCATEGORY_NAME":"Security","OBJECTIVES":[{"EXAM_SERIES_CODE":"C1000-156","EXAM_OBJECTIVE_ID":0,"EXAM_OBJECTIVE_TITLE":"System Configuration","PERCENTAGE_OF_OBJECTIVE_QUESTIONS":"20","EXAM_OBJECTIVE_DESCRIPTION":"<ol><li>Perform license management</li><li>Administer managed hosts</li><li>Understand distributed architecture</li><li>Manage configuration and data backups</li><li>Configure custom SNMP and email templates</li><li>Manage network hierarchy</li><li>Use and manage reference data</li><li>Manage automatic update</li><li>Demonstrate the use of the asset database</li><li>Install and configure apps</li></ol>","EXAM_OBJECTIVE_ORDER":0,"TINSERTTS":"2025-07-14 18:51:33.709017","TLASTUPDTS":"2025-07-14 18:51:33.709017"},{"EXAM_SERIES_CODE":"C1000-156","EXAM_OBJECTIVE_ID":1,"EXAM_OBJECTIVE_TITLE":"Performance Optimization","PERCENTAGE_OF_OBJECTIVE_QUESTIONS":"13","EXAM_OBJECTIVE_DESCRIPTION":"<ol><li>Construct identity exclusions</li><li>Deal with resource restrictions</li><li>Configuring, tuning and understanding rules</li><li>Index management</li><li>Search management</li><li>Manage routing rules and event forwarding</li></ol>","EXAM_OBJECTIVE_ORDER":1,"TINSERTTS":"2025-07-14 18:51:33.711965","TLASTUPDTS":"2025-07-14 18:51:33.711965"},{"EXAM_SERIES_CODE":"C1000-156","EXAM_OBJECTIVE_ID":2,"EXAM_OBJECTIVE_TITLE":"Data Source Configuration","PERCENTAGE_OF_OBJECTIVE_QUESTIONS":"14","EXAM_OBJECTIVE_DESCRIPTION":"<ol><li>Manage flow sources</li><li>Manage log sources</li><li>Export event and flow data</li><li>Vulnerability information source configuration</li><li>Manage custom event and flow properties</li><li>Manage custom log source types</li><li>Manage data obfuscation&nbsp;</li></ol>","EXAM_OBJECTIVE_ORDER":2,"TINSERTTS":"2025-07-14 18:51:33.713733","TLASTUPDTS":"2025-07-14 18:51:33.713733"},{"EXAM_SERIES_CODE":"C1000-156","EXAM_OBJECTIVE_ID":3,"EXAM_OBJECTIVE_TITLE":"Accuracy Tuning","PERCENTAGE_OF_OBJECTIVE_QUESTIONS":"10","EXAM_OBJECTIVE_DESCRIPTION":"<ol><li>Understand and implement Anomaly Detection Engine rules</li><li>Manage and use building blocks</li><li>Manage content packs</li><li>Distinguish native information sources</li><li>Configure integrations</li></ol>","EXAM_OBJECTIVE_ORDER":3,"TINSERTTS":"2025-07-14 18:51:33.728985","TLASTUPDTS":"2025-07-14 18:51:33.728985"},{"EXAM_SERIES_CODE":"C1000-156","EXAM_OBJECTIVE_ID":4,"EXAM_OBJECTIVE_TITLE":"User Management","PERCENTAGE_OF_OBJECTIVE_QUESTIONS":"6","EXAM_OBJECTIVE_DESCRIPTION":"<ol><li>Manage users</li><li>Create and update security profiles</li><li>Create and update user roles</li><li>Manage user authentication and authorization</li></ol>","EXAM_OBJECTIVE_ORDER":4,"TINSERTTS":"2025-07-14 18:51:33.741701","TLASTUPDTS":"2025-07-14 18:51:33.741701"},{"EXAM_SERIES_CODE":"C1000-156","EXAM_OBJECTIVE_ID":5,"EXAM_OBJECTIVE_TITLE":"Reporting, Searching, and Offense Management","PERCENTAGE_OF_OBJECTIVE_QUESTIONS":"13","EXAM_OBJECTIVE_DESCRIPTION":"<ol><li>Manage reports</li><li>Utilize different search types</li><li>Manage offenses</li><li>Sharing content among users&nbsp;</li></ol>","EXAM_OBJECTIVE_ORDER":5,"TINSERTTS":"2025-07-14 18:51:33.750895","TLASTUPDTS":"2025-07-14 18:51:33.750895"},{"EXAM_SERIES_CODE":"C1000-156","EXAM_OBJECTIVE_ID":6,"EXAM_OBJECTIVE_TITLE":"Tenants and Domains","PERCENTAGE_OF_OBJECTIVE_QUESTIONS":"8","EXAM_OBJECTIVE_DESCRIPTION":"<ol><li>Differentiate network hierarchy and domain definition</li><li>Manage domains and tenants</li><li>Allocate licenses for multi-tenant</li><li>Assign users to tenants&nbsp;</li></ol>","EXAM_OBJECTIVE_ORDER":6,"TINSERTTS":"2025-07-14 18:51:33.753439","TLASTUPDTS":"2025-07-14 18:51:33.753439"},{"EXAM_SERIES_CODE":"C1000-156","EXAM_OBJECTIVE_ID":7,"EXAM_OBJECTIVE_TITLE":"Troubleshooting","PERCENTAGE_OF_OBJECTIVE_QUESTIONS":"16","EXAM_OBJECTIVE_DESCRIPTION":"<ol><li>Review and respond to system notifications</li><li>Troubleshoot common documented issues</li><li>Configure, manage and troubleshoot applications</li><li>Perform healthchecks</li><li>Basic GUI REST-API usage&nbsp;</li></ol>","EXAM_OBJECTIVE_ORDER":7,"TINSERTTS":"2025-07-14 18:51:33.775467","TLASTUPDTS":"2025-07-14 18:51:33.775467"}],"RESOURCES":[{"TYPE":"Study Guide Content URLs","RESOURCES":[{"RESOURCE_TITLE":"QRadar SIEM V7.5 Administration - Exam C1000-156 Preparation Guide","RESOURCE_DESCRIPTION":"<p>This course provides materials to help guide an individual preparing for the IBM Certified Administrator&nbsp; - QRadar SIEM V7.5 Administration exam.</p>","RESOURCE_URL":"http://learn.ibm.com/course/view.php?id=14048","RESOURCE_TYPE_NAME":"Study Guide Content URLs"}]}],"RELATED_CERTS":[{"PARTNERWORLD_CODE":"C9004600","CREDENTIAL_TITLE":"IBM Certified Administrator - Security QRadar SIEM V7.5"}],"PREREQS":[],"ASSOC_COURSES":[],"ASSOC_NON":[],"ASSOC_PATHS":[],"ASSESSMENT":"A1000-156","LANGUAGES":"English","PRICE":200,"STUDY_GUIDE_URL":"https://s3-api.us-geo.objectstorage.softlayer.net/credman-prod/exam/C1000-156_STU_stucC1000156.pdf?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=88673a689335411dbbef07d4969c34c2%2F20260926%2Fus-geo%2Fs3%2Faws4_request&X-Amz-Date=20260926T214106Z&X-Amz-Expires=86400&X-Amz-SignedHeaders=host&response-content-disposition=inline%3B%20%3B%20filename%3D%22C1000-156_STU_stucC1000156.pdf%22&X-Amz-Signature=9a0a769d350c59880a6808168898854d616a3f9b26ab3dfc2eb969c62c47084d","SAMPLE_EXAM_URL":"https://s3-api.us-geo.objectstorage.softlayer.net/credman-prod/exam/C1000-156_SAM_samc1000156.pdf?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=88673a689335411dbbef07d4969c34c2%2F20260926%2Fus-geo%2Fs3%2Faws4_request&X-Amz-Date=20260926T214106Z&X-Amz-Expires=86400&X-Amz-SignedHeaders=host&response-content-disposition=inline%3B%20%3B%20filename%3D%22C1000-156_SAM_samc1000156.pdf%22&X-Amz-Signature=faf4adce07c0a3548bbe5b425c0076836995f99c4a5cb47f1e7bfbb039b75748"}