Free Practice Questions for the IBM Certified Administrator C1000-197 Exam (2026 Updated)

"IBM Security Guardium is designed to help safeguard critical data. Guardium is a comprehensive data protection platform that enables security teams to automatically analyze what is happening in sensitive-data environments … to help minimize risk, protect sensitive data from internal and external threats." The deployment guide adds: "Database activity monitoring is the ability to monitor and audit activities into and out of the database server."

Real-time monitoring of sensitive-data access, schema and data changes, and privileged-user (DBA) actions is the function that directly strengthens data security. Policies on those activities can alert, log, or block.

A: This describes audit-repository scalability and consolidation. It supports compliance and retention rather than active protection.

B: Vulnerability Assessment is a hardening function. It finds configuration gaps in the database and operating system tiers, and is not described as real-time protection.

C: As worded, this is not a Guardium capability. Guardium identifies application end users through pooled connections and does not track users who never touch the data path.

Technical basis: The S-TAP agent captures activity at the database server, and the collector evaluates it against policy rules such as sensitive objects and privileged users.

"Alert Per Match: sends notifications each time the rule is satisfied. This is appropriate for a condition requiring attention each and every time it occurs." The others are described as: "Alert Daily: sends notifications only the first time the rule is matched each day. Alert Once Per Session: sends notifications only once for each session in which the rule is matched. … Alert Only: … Alert Only does not notify of policy violations."

Alert Per Match: This is the highest-volume option. Use it for high-severity events, and expect many messages if the rule is broad.

Alert Only: With syslog notification, messages go directly to /var/log/messages . For other notification types they go to the MESSAGE table. It does not log a policy violation.

Thresholds: You can set thresholds on violation rules that have a high severity and an Alert Per Match action.

Template note: The %%RecordsAffected variable returns no value in a message template for Alert Only actions that use syslog.

"admin-console-only: A user that is specified by this role can only access the admin console tab."

The role-to-application mapping gives this role Support access (Support Information Gathering, Support Information Results, Support Maintenance) and System Configuration. These are operational functions, and the role carries no access to reports, policies or audit data. The admin role, by contrast, "provides the default layout and access for Guardium administrators" and by default has access to all objects.

Admin Console: The Administration Console is where an operator restarts services and the portal, runs support tools and views system health. Restricting a user to this tab lets them perform maintenance without seeing monitored data.

Roles that do not exist: "System-admin" and "Maintenance" are not default or sample Guardium roles. The default roles are user, admin, accessmgr, cli, inv, datasec-exempt and review-only, plus the sample roles such as dba, infosec, audit, admin-console-only, cas and fam.

Separation of duties: The admin role and the access manager role cannot be assigned to the same user.

"store system patch install < type > < date > < time > where < type > is sys, ftp, scp, or cd and < date > and < time > are the patch installation request date and time formatted as YYYY-mm-dd and hh:mm:ss. If date and time are not entered or if 'now' is entered, the installation request time is NOW." The type descriptions add: "The sys option is for use when installing a second or subsequent patch from a compressed file that has been copied to the Guardium system … Install from /var/log/guard/patches. The ftp and scp options copy a compressed patch file from a network location to the Guardium system."

Of the five options, only ftp and sys are on the valid list. http , iso and sftp are not accepted types. scp and cd are the other two valid types, but they are not offered here.

Patches in ZIP format: Unzip them outside the Guardium system before uploading.

Timing: Install during quiet periods. Audit processes are stopped while a patch installs.

Order: Patch top-down: Central Manager, then aggregators, then collectors.

Verification: Run show system patch installed to confirm the result, which should read "DONE: Patch installation Succeeded."

Central Manager: The CM can also push patches to managed units and show per-unit patch status and history.

"You can use your policies' rules to create active threat analytics case types, by setting a threshold on specific violation policy rules. … Use the API to define thresholds on rules. You cannot define thresholds in the GUI. … Add or modify the threshold by using the API command add_threshold_to_rule or update_threshold_in_rule. For example, to add the threshold 25 to ruleNNN in policyAAA: grdapi add_threshold_to_rule policy_name=policyAAA rule_name=ruleNNN threshold=25."

A new threat category is created by adding a threshold to a rule. Option B has the right verb ( add ) and the right parameters: policy_name , rule_name and threshold . Options A and C use update , which only changes a threshold that already exists. Option C also uses threshold_value , which is not a valid parameter. Option D omits rule_name .

Eligible rules: Thresholds apply to violation rules with a severity of HIGH whose action is alert per match.

Behavior: When the threshold is exceeded within any one hour, a case is created. The case type is the rule's name, and it appears in the Active Threat Analytics cases table.

Activation: Changes apply on the policy schedule. For an installed policy, cases appear only after the policy is reinstalled, from the next day.

Companion APIs: list_policy , list_policy_rules , list_rules_with_threshold and remove_threshold_from_rule .

On the Alerter's SMTP tab: "If you selected Send alert emails using SMTP, click Test Connection to open the Test connection window. You can enter an email address to send the test alert and click OK to send a test email to the address. Click OK without entering an address to test whether the connection is open (and return a message)."

Test Connection in the Alerter is the built-in verification mechanism. Syslog files retrieved through the fileserver are for log review, not an SMTP test. iptraf is a Linux traffic monitor and has no email-test function. There is no "Failed Messages" report in the product.

What the test proves: The no-address test only shows that the SMTP port is reachable. Entering a recipient address sends a real test message.

Configuration needed: At a minimum, the host or IP, the port (default 25) and the return-path address.

Optional settings: STARTTLS and SMTP credentials.

Restart: The Alerter does not use a new configuration until it is restarted.

End-to-end delivery: If you need proof of delivery through the relay, use the Test Email interactive query. It sends mail through the configured SMTP server without needing a real alert to fire.

"The Guardium S-TAP is a lightweight software agent installed on database servers and file servers. … For data activity monitoring, the S-TAP monitors activity between the client and the database and forwards that information to the Guardium collector. The database traffic is logged into the collector based on criteria specified in the security policy." By contrast, for network mirroring (SPAN, N-TAP): "This method only captures network traffic, not local traffic within the database server host. IBM strongly encourages [you] to use an S-TAP instead."

Only an agent on the host can see local connections, such as shared memory, named pipes and loopback. Network mirroring sees only what crosses the wire.

How it intercepts: On Linux and UNIX, K-TAP is a kernel module that hooks the communication between client and server. A-TAP handles encrypted traffic in the application layer. Exit libraries serve Db2, Informix and Teradata. On Windows the S-TAP uses a Windows driver.

Overhead: The S-TAP typically accounts for a few percent of CPU, with negligible impact in most installations.

Other options: "N-TAP" is an optional name for network mirroring and not an agent. "E-TAP" and "P-TAP" are not Guardium agent types. (The related "PCAP" in Question 15 is a capture mechanism.)

"Use one of the following methods to install CAS: From the Windows installer wizard. … From the command line interface, as described in Installing CAS from the CLI. From the Guardium Installation Manager (GIM) as described in Installing CAS with GIM." And: "To install CAS from the command line, call setup.exe with the appropriate parameters, as follows: Setup.exe -PARAMETER value. Use a space between each parameter and value pair. Do not use an equal sign (=)."

Of the four options, only the command line is an installation method. The S-TAP monitors database traffic and does not deploy CAS. Workflow Automation and the Audit Process feature are reporting and compliance functions.

Prerequisites: Microsoft .NET 4.5 or later and roughly 2 GB of disk space. If .NET is missing, Guardium installs it and needs an extra 5 GB.

Ports: TCP 16017 for clear CAS and TCP 16019 for TLS-encrypted CAS.

Example: setup.exe -UNATTENDED -INSTALLPATH "C:\Program Files (x86)\IBM\CAS" -APPLIANCE < collector_IP > -LOCALIP < server_IP > .

Service and Java: The service is casclient (displayed as IBM Security Guardium Change Audit System). The JVM location is set under [RUNTIMELIB] in casclient.cfg .

Scale: Use the CLI form or GIM for large deployments.

"The Anomaly Detection process runs every polling interval to create and save, but not send, correlation alert notifications that are based on an alert's query."

The polling interval is the engine's wake-up cycle. Each alert's own Run Frequency, which is the number of minutes between runs of that alert's query, is evaluated within that cycle.

Setting it: store anomaly-detection poll < minutes > sets the polling interval. The Active on Startup option in the Anomaly Detection configuration starts the engine automatically after a restart.

Related timing fields: The accumulation interval is the look-back window of the query. The notification frequency controls how often emails are sent. The Alerter has its own polling interval, in seconds, for checking and sending queued messages.

Testing: If a test alert does not fire, check that Anomaly Detection is started and that its polling interval is short enough for the test.

Central Manager: After distributing the configuration, restart the managed units.

"support show port open: This command is similar to using telnet to detect an open TCP port locally or on a remote host. If we are able to connect successfully, a message similar to the following displays: Connection to 127.0.0.1 8443 port [tcp/*] succeeded! If you are unable to connect, a message similar to the following displays: Connect to 127.0.0.1 port 1 (tcp) failed: Connection refused. Syntax: support show port open < IP > < port > — IP must be a valid IPv4 address; port must be an integer in the range 1–65535."

Running support show port open < smtp_ip > 25 from the appliance CLI performs a TCP connection test to the mail relay. It confirms routing, firewall and listener status from the appliance's own network stack.

Scope: This verifies network reachability only. It does not prove mail is accepted or delivered. For that, use the Alerter's Test Connection with a recipient address, or the Test Email diagnostic.

Other options: The two tcpdump forms capture packets and do not test a connection. support netconnection is not a valid Guardium CLI command.

Syntax: The command takes an IP address, so a hostname will not work.

"Enable the Investigation Dashboard with the GuardAPI command: grdapi enable_quick_search schedule_interval=2 schedule_units=MINUTE. To enable the Investigation Dashboard on all managed units of an environment, use the all=true parameter: grdapi enable_quick_search schedule_interval=2 schedule_units=MINUTE all=true. Note: This GuardAPI executes many configuration scripts and, depending on the current unit status, can take a few minutes."

Without all=true the command applies only to the local unit, which is option B. Options A and D use verbs that do not exist.

Violations: By default violations are not in search results. Add includeViolations=true to include them.

Permissions: Log in as a user or administrator with the CLI role.

Dependencies: Outlier-detection data in the Investigation Dashboard needs Quick Search enabled. The schedule interval controls how often the search index is refreshed.

Health: The dashboard's status appears in the deployment health views. Monitoring and automatic recovery runs every 20 minutes on the Central Manager.

"After you make a change to a policy (such as changes to group members, policy rules, or actions), you must reinstall the policy. You can either reinstall the policy on a managed unit, or select Policy installation schedule from the configuration profile, which allows you to schedule a distribution that pushes the policy from the central manager to specified managed units."

An installed policy is a snapshot loaded into the analysis engine. Editing the definition does not alter the loaded copy until the policy is installed again.

Not needed: Inspection engines and the collector do not need restarting. Policy installation is a runtime operation.

Central management: The Central Manager can push policy to managed units, either on demand or through a distribution schedule in a configuration profile.

Install actions: Install and Override, Install First and Install Last decide where the policy sits among the installed policies

Rules and groups: A change to group membership has the same requirement. The Risk Spotter daily process, for example, updates its risky-users group and reinstalls the policy itself.

Option D: Individual rules are not installed on their own through the GUI. The unit of installation is the policy.

"Guardium applies the Risk Spotter algorithm to the audited data modules, to analyze multiple risk indicators and to calculate the overall risk scores of risky users." The indicator table lists:

Threat Analytics: "Identified high and medium potential risks from Guardium Advanced Threat Analytics."

Sensitive objects: "The number of queries on sensitive data related to the DB user."

Its dynamic risk assessment "considers many risk factors, including: outliers, vulnerability, volume of activities, access to sensitive data, type of commands (privileges)."

The full indicator set also covers violations, vulnerability (failed assessments), administrative, DDL, DML and select query ratios, high-volume activity, and off-work activity. Every indicator measures risky behavior.

A and C: Activity during work hours and low volume are the inverse of the real indicators, which are off-work activity and high-volume activity.

E: No data access carries no risk signal.

Weighting: The algorithm applies a relevant weight to each indicator and then ranks users and shows risk trends across the system.