IBM Security QRadar SIEM V7.4.3 Administration — Question 27

A company plans to collect event data from two remote sites that have slow WAN links. These remote sites do not generate many events per second. The company’s deployment professional wants to deploy a system that can use EPS limiters to send events to the Event Processor to overcome WAN limitations.
What type of appliance can be used to meet this requirement?

Answer options

• A. Packet Capture appliance
• B. Data Gateway
• C. Flow Collector
• D. Disconnected Log Collector

Correct answer: D

Explanation

The Disconnected Log Collector is designed to collect events in environments with limited connectivity and can apply EPS limiters to control the flow of events sent to the Event Processor. The other options, such as the Packet Capture appliance, Data Gateway, and Flow Collector, do not specifically address the need for managing event transmission under slow WAN conditions.