An IBM Security QRadar SIEM V7.2.8 Administrator has been retaining event data for compliance purposes. Data is no longer necessary and the administrator needs to delete a specific retention bucket.
Where does the Administrator do this configuration?
A. Administrator needs to reset the SIM and purge the file system
B. Admin tab -> Data Sources -> Flow retention icon -> Select the flow retention bucket -> Delete
C. Admin tab -> Data Sources -> Event retention icon -> Select the event retention bucket -> Delete
D. Admin tab -> Data Sources -> Event or Flow retention -> Double-click the first empty row in the table -> Delete
|
Download Printable PDF. VALID exam to help you PASS. |
 |