IBM Security QRadar SIEM V7.4.3 Administration — Question 19

What does QRadar attempt to do when the system generates “Accumulator is falling behind” warnings?

Answer options

• A. QRadar tries to aggregate the events and flows during the next 60 seconds.
• B. QRadar automatically drops the incoming events and flows during that time period.
• C. The events that QRadar processes during that period are categorized as stored.
• D. Time-series graphs and reports omit columns for the period when the problem occurred.

Correct answer: C

Explanation

The correct answer is C because when the 'Accumulator is falling behind,' QRadar processes events but categorizes them as stored to prevent data loss. Options A and B are incorrect as QRadar does not try to aggregate or drop events during this warning. Option D is also wrong, as it pertains to reporting rather than event processing.