- How the Eight Content Areas Fit Together
- Exam Mechanics That Shape How You Study the Domains
- Domain 1: System Configuration (20%)
- Domain 2: Performance Optimization (13%)
- Domain 3: Data Source Configuration (14%)
- Domain 4: Accuracy Tuning (10%)
- Domain 5: User Management (6%)
- Domain 6: Reporting, Searching, and Offense Management (13%)
- Domain 7: Tenants and Domains (8%)
- Domain 8: Troubleshooting (16%)
- Sequencing the Domains in Your Prep Calendar
- Frequently Asked Questions
- The exam has eight published sections; System Configuration is largest at 20%, then Troubleshooting at 16%.
- You need 38 correct answers out of 62 questions within 90 minutes to pass.
- Scope is on-premises QRadar SIEM V7.5; QRadar on Cloud (QRoC) is explicitly excluded.
- Formats include single-answer, multiple-response, and ordering questions; no performance-based lab is documented.
How the Eight Content Areas Fit Together
The IBM Certified Administrator - Security QRadar SIEM V7.5 credential (C9004600) is earned by passing exam C1000-156, and its blueprint is organized around what an administrator actually does on an on-premises QRadar deployment: build the system, keep it fast, feed it log sources, tune it, control who can use it, extract value from searches and offenses, segment it for multiple customers or business units, and fix it when it breaks. IBM publishes eight objective sections, and the weights below are the published percentages.
| Domain | Published Weight | Character of the Content |
|---|---|---|
| 1. System Configuration | 20% | Deployment architecture, hosts, networks, and core settings |
| 2. Performance Optimization | 13% | Keeping the deployment responsive and within capacity |
| 3. Data Source Configuration | 14% | Log sources, protocols, and getting events and flows in |
| 4. Accuracy Tuning | 10% | Reducing false positives and sharpening detection |
| 5. User Management | 6% | Roles, permissions, and authentication |
| 6. Reporting, Searching, and Offense Management | 13% | Daily analyst-facing operations an admin supports |
| 7. Tenants and Domains | 8% | Multi-tenant and segmented environments |
| 8. Troubleshooting | 16% | Diagnosing and resolving operational problems |
IBM's study guide also lists question allocations per section (12, 8, 9, 6, 4, 8, 5 and 10 questions in blueprint order). Treat the published percentages as the official weighting and the question counts as a practical hint about how many items each area contributes. The guide does not state which questions are scored versus unscored, so prepare for every section.
If you want the broader preparation plan that surrounds this domain breakdown, the C1000-156 study guide covers pacing in more depth, and this article stays focused on what each content area demands.
Exam Mechanics That Shape How You Study the Domains
Before diving into content, a few verified logistics affect how you approach the blueprint:
- Length and timing: 62 questions in 90 minutes, which works out to roughly 85 seconds per question if you spread time evenly.
- Passing mark: 38 correct answers out of 62. Many commercial sites quote a rounded percentage, but the issuer's exact count is what matters. See the C1000-156 passing score breakdown for what that threshold means in practice.
- Question styles: IBM's official sample shows single-answer multiple choice, multiple-response selection, and ordering/sequence questions. Ordering items reward people who have actually performed a procedure rather than read about it.
- Delivery: English, proctored through Pearson VUE, with test-center or OnVUE availability depending on exam and country. IBM policy disallows notes and unauthorized materials.
- Scope boundary: On-premises QRadar, including the named administration apps. QRadar on Cloud is out of scope.
For exact eligibility, see the C1000-156 requirements guide; the short version is that one exam is required and no degree, training-hour log, or earlier certification is listed. Fee questions are covered in the C1000-156 certification cost breakdown, which notes that the current official USD amount could not be confirmed and that a secondary source reports USD 200.
Domain 1: System Configuration (20%)
The largest section deserves the largest share of your time. System Configuration covers how a QRadar deployment is assembled and how its core settings are managed. Because the exam is limited to on-premises QRadar, expect questions about the components you manage yourself rather than anything handled by a cloud provider.
What to Master in System Configuration
Think like the person who stands the deployment up and keeps its configuration coherent as it grows.
- How the console and the other deployment components relate to each other, and how hosts are added and managed in the deployment
- Network hierarchy configuration and why it matters for how traffic and assets are classified
- Deployment editor and deploy-changes behavior, including which changes require a deployment to take effect
- Backup, restore, and retention settings that protect configuration and data
- Applications and extensions, including the administration apps named in IBM's scope
- System-level settings such as time, licensing, and update handling
This domain is where ordering questions are most likely to appear, since many administrative tasks are sequences: make a change, validate it, then deploy it. Rehearse the real workflow in a lab so the correct order is muscle memory rather than a guess.
Domain 2: Performance Optimization (13%)
Performance Optimization is about keeping QRadar healthy under load. The questions tend to present a symptom and ask which adjustment is appropriate, so you need to understand the cause-and-effect relationships inside the platform rather than memorize isolated settings.
What to Master in Performance Optimization
Focus on where load comes from and which levers reduce it without hurting visibility.
- How event and flow rates affect processing, storage, and search responsiveness
- Search and rule workloads that consume resources, and how to manage them
- Data retention and storage considerations, including how they influence capacity
- Monitoring system health so you notice degradation before users do
- Appropriate use of tuning controls versus simply adding capacity
A common trap is choosing the heaviest-handed fix. Exam writers favor answers that address the root cause with the smallest effective change, so always ask what the least disruptive correct action would be.
Domain 3: Data Source Configuration (14%)
This is the section most directly tied to day-to-day SIEM value: if data does not arrive correctly, nothing downstream works. It covers getting log sources and flow sources into QRadar and making sure they are parsed and recognized correctly.
What to Master in Data Source Configuration
Know the paths data takes into the system and the decisions an administrator makes along the way.
- Adding and managing log sources, including automatic discovery versus manual configuration
- Common collection protocols and when each is appropriate
- Device support modules and how they influence parsing and categorization
- Flow sources and how flow collection differs from event collection
- Log source groups, extensions, and handling unparsed or unrecognized events
- Event collector and processor roles in distributing collection
Because enterprise logging is listed as prerequisite knowledge, the exam will not teach you what syslog is, but it will expect you to configure ingestion correctly and diagnose why a source is not reporting.
Domain 4: Accuracy Tuning (10%)
Accuracy Tuning is the discipline of making QRadar's detections trustworthy. A noisy SIEM erodes analyst confidence, so this section tests whether you can reduce false positives while preserving true detections.
What to Master in Accuracy Tuning
Learn the building blocks QRadar uses to decide that something deserves attention.
- Custom rules and building blocks, and how tests combine to produce offenses
- Tuning false positives through rule adjustments, thresholds, and exclusions
- Reference sets and reference data used to refine rule logic
- Asset and network context that improves the accuracy of correlation
- Custom event and flow properties that expose the fields rules rely on
Offense analysis itself is listed as prerequisite knowledge, so questions here lean toward the administrator's tuning actions, not the analyst's investigation steps.
Domain 5: User Management (6%)
The smallest section is still worth securing, because its content is concrete and highly learnable. With a modest question count, a few correct answers here can offset misses in harder areas.
What to Master in User Management
Understand how access is defined and how it connects to the rest of the platform.
- User roles and security profiles, and how they limit what a user can see and do
- Creating and managing user accounts and user roles
- Authentication options and how external authentication integrates with QRadar
- How security profiles interact with the domain and tenant model covered later
Pay special attention to the distinction between a role, which governs functions a user may perform, and a security profile, which governs the data a user may see. Exam writers like to test whether you can tell them apart.
Domain 6: Reporting, Searching, and Offense Management (13%)
Although offense and log analysis is assumed knowledge, this domain tests the administrator's side of those activities: configuring and supporting the tools analysts rely on.
What to Master in Reporting, Searching, and Offense Management
Be fluent in how searches are built, saved, scheduled, and shared.
- Building and saving event and flow searches, including grouping, filters, and time ranges
- Creating, scheduling, and distributing reports and managing report templates and groups
- Offense lifecycle administration, such as closing reasons, ownership, and offense rules and indexing
- Dashboards and how they present searches and saved results
- Indexing choices that make frequently used searches faster
This domain overlaps with Performance Optimization, since poorly designed searches and reports are a classic source of slowdown. Studying the two together helps you answer scenario questions that straddle both.
Domain 7: Tenants and Domains (8%)
Tenants and Domains covers segmenting a single QRadar deployment so different groups see only their own data. It is a compact section but conceptually dense, and it is easy to confuse the terminology if you have not practiced it.
What to Master in Tenants and Domains
Understand how segmentation is defined and enforced.
- What domains are and how they separate log sources, flows, and other objects
- How tenants relate to domains and why multi-tenant designs are used
- How security profiles tie users to the domains they may access
- Overlapping IP address handling across segmented environments
- Which objects and rules are domain-aware and how that affects configuration
Domain 8: Troubleshooting (16%)
The second-largest section is where hands-on experience pays off most. Troubleshooting questions describe a failure and ask you to identify the cause or the correct corrective step. Candidates who have only read documentation tend to struggle here, which is why IBM stresses extensive practical QRadar knowledge.
What to Master in Troubleshooting
Build a repeatable diagnostic habit: confirm the symptom, isolate the layer, then apply the narrowest fix.
- Log source problems, such as sources that stop reporting or events that arrive unparsed
- Deployment and connectivity issues between components
- Service and process health, and where to find messages that explain failures
- Search, rule, and report problems that trace back to configuration
- Using logs and system notifications to confirm a diagnosis before acting
Key Takeaway
Troubleshooting questions reward process over trivia. When two answers look plausible, prefer the one that verifies the cause first and changes the least. Practice by deliberately breaking things in a lab, such as a misconfigured log source, and then repairing them.
Sequencing the Domains in Your Prep Calendar
Study order should follow dependency and weight, not the numeric order of the blueprint. System Configuration comes first because every other domain assumes a working deployment, and Troubleshooting comes last because it draws on everything else. Here is one sequencing that respects those dependencies.
System Configuration
- Walk through deployment components, network hierarchy, and deploy-changes workflow in a lab
- Practice the ordered administrative sequences likely to appear as ordering questions
Data Source Configuration and Accuracy Tuning
- Add log sources through several protocols and examine how parsing affects rules
- Tune a rule to remove a false positive and note the effect
Performance, Reporting, and Offense Administration
- Build and schedule searches and reports, then observe their resource impact
- Review indexing and retention choices
User Management, Tenants and Domains, then Troubleshooting
- Configure roles, security profiles, and domains as one access model
- Finish with fault-finding drills and timed practice at 62 questions in 90 minutes
That timeline is a template, so lengthen it if you are new to QRadar administration. Candidates with day-to-day admin experience can compress it, while those coming from an analyst background should spend extra time on Domains 1, 2, and 7, which are administrator-specific. For a read on how demanding the exam is relative to your background, see how hard the C1000-156 exam is, and for outcome data context see the C1000-156 pass rate discussion.
When you are ready to test yourself against realistic question styles, the C1000-156 practice tests let you rehearse single-answer, multiple-response, and ordering formats under the real time limit. A one-page recap is also available in the C1000-156 cheat sheet, which is handy for final review.
Frequently Asked Questions
System Configuration is the largest at 20%, followed by Troubleshooting at 16%. Together they account for more than a third of the blueprint, so they deserve the most preparation time.
The exam has 62 questions and requires 38 correct answers to pass, with 90 minutes allowed. IBM's study guide does not identify a scored versus unscored split, so treat every question as counting.
No. The scope is on-premises QRadar SIEM V7.5, including the named administration apps. QRadar on Cloud (QRoC) is explicitly excluded, so do not spend study time on cloud-specific behavior.
No performance-based lab is documented. IBM's official sample shows single-answer multiple choice, multiple-response selection, and ordering questions. Practical experience still helps a great deal, especially for ordering and troubleshooting items.
IBM lists security and SIEM concepts, TCP/IP, offense and log analysis, enterprise logging, flows, QRadar Network Insights, and QRadar Incident Forensics as prerequisite knowledge that this exam does not measure. Build that foundation first, then use the eight domains to structure your administration study. For a broader orientation to the credential itself, see what the C1000-156 certification is.