Free C1000-156 Practice Test Questions and Answers (2026) | Cert Empire Practice Questions

The standard method in IBM QRadar to segregate events from a single log source into multiple domains is by using custom event properties. A custom property is configured to parse a unique identifier from the event payload (e.g., a customer name, IP address, or virtual firewall context). The domain management system is then configured to use this custom property's output. When an event is processed, QRadar extracts the identifier and assigns the event to the corresponding domain, enabling multi-tenancy from a centralized log collector.

A. Saved searches on the Network Activity tab are for viewing network flow data, not for assigning log events to domains. Domain assignment occurs during event processing, not during a search.

B. The Assistant app is a troubleshooting and guidance tool. It does not provide the primary interface for configuring the logic required to route events from one source to multiple domains.

D. The Use Case Manager app is used for managing and tuning security rules, reports, and their associated building blocks. It operates on events after they have been assigned to a domain.

1. IBM Security QRadar SIEM Administration Guide: In the section on Domain Management, the documentation explicitly states the procedure for this scenario. It details creating a custom property to extract a domain-defining field from the event payload and then using that property in the domain definition.

Reference: IBM Security QRadar SIEM Administration Guide, (Version 7.5.0), Chapter: "Domains", Section: "Domain definition for events". The guide states, "To assign events from a single log source to different domains, you must create a custom property that you can use to assign the incoming events to a domain."

2. IBM Security Learning Academy: Courseware for QRadar Administration covers multi-tenancy and domain segmentation. These materials explain that for log sources that aggregate data from multiple tenants (like a central syslog server), custom properties are the mechanism to parse and direct events to the correct domain.

Reference: IBM Security Learning Academy, QRadar SIEM Administration Course, Module on Multi-tenancy and Domains. The course material demonstrates creating a regex-based custom property and applying it to domain definitions.

Data deobfuscation in IBM QRadar is a cryptographic process that reverses data obfuscation. It relies on asymmetric key cryptography, where a public key is used to obfuscate (encrypt) data, and a corresponding private key is used to deobfuscate (decrypt) it. For security, the private key itself is protected by a password. Therefore, to view the original, sensitive data, an administrator must have access to both the specific private key that corresponds to the public key used for obfuscation and the correct password to unlock that private key.

A. Public key and the password for the key that is used to obfuscate data

The public key is used for obfuscation (encryption), not deobfuscation (decryption).

C. Private key and public key that is used to obfuscate data

The public key is not required for the deobfuscation process; only the private key and its password are necessary.

D. Public key and the password for the private key that is used to obfuscate data

The public key cannot deobfuscate data. This is the exclusive function of the corresponding private key.

1. IBM QRadar SIEM Documentation, "Data obfuscation management": "To deobfuscate data, you must have the private key that is associated with the public key that was used to obfuscate the data... To deobfuscate data, you must have the private key and the password for the key." (This statement is found in the QRadar Administration Guide across multiple versions, including 7.5.0).

2. IBM QRadar SIEM Documentation, "Managing data obfuscation keys": "When you create an obfuscation key, you are prompted to enter a password for the private key. The password is used to deobfuscate data." (This section details the key creation process, explicitly linking the password to the private key for deobfuscation purposes).

In a distributed IBM QRadar deployment, the upgrade process follows a strict hierarchical order. The QRadar Console is the central management appliance for the entire deployment. It must be upgraded first to ensure it can maintain communication and deploy updated configurations to all subordinate managed hosts. The Console software is designed to be backward-compatible, allowing it to manage hosts that are still on the previous version. After the Console is successfully upgraded, the remaining managed hosts, such as Event Processors and Flow Processors, can be upgraded in any subsequent order. This ensures a stable and controlled upgrade process, minimizing potential service disruption.

A. Any order: This is incorrect because upgrading a managed host before the Console can lead to version mismatches, communication failures, and deployment errors.

C. Flow Processor followed by remaining hosts: This is incorrect. The Flow Processor is a managed host and must be upgraded only after the central QRadar Console has been successfully upgraded.

D. Event Processor followed by remaining hosts: This is incorrect. The Event Processor is a managed host and, like all others, must be upgraded after the QRadar Console.

1. IBM QRadar Documentation (Version 7.5.0): In the section "QRadar upgrade overview," the procedure is explicitly stated: "In a distributed QRadar environment, you must upgrade the QRadar Console first. After the QRadar Console is upgraded, you can upgrade the managed hosts in your deployment in any order."

Source: IBM. (2023). Upgrading QRadar to 7.5.0 Update Package 8 > QRadar upgrade overview. IBM Documentation.

2. IBM QRadar SIEM Administration Guide: The guide details the management hierarchy where the Console is the primary appliance. The section on software updates reinforces this principle, stating that patches and upgrades must be applied to the Console before being distributed to managed hosts.

Source: IBM. (2023). IBM Security QRadar SIEM Administration Guide, 7.5.0. Chapter: "Software updates," Section: "Installing software updates on QRadar systems."

In IBM QRadar SIEM, the Domain Management feature is designed to segregate data, typically for multi-tenant or segmented network environments. This segregation is achieved by assigning specific data-generating assets to a defined domain. The primary sources of data that QRadar processes are events and flows. Therefore, log sources, which generate event data, and flow collectors, which process and generate flow data, are the fundamental objects that can be assigned to a domain to ensure that all data they produce is tagged and isolated within that domain.

A. Users: Users are assigned to domains to control their data access permissions, but they are not a source of event or flow data.

B. Rules: Rules are logic constructs that operate on data within domains; they are not data sources that are assigned to a domain.

E. X-Force Integration Feed: The X-Force feed is a global source of threat intelligence data applied across the entire QRadar deployment, not a tenant-specific data source to be segregated by domain.

1. IBM QRadar SIEM Administration Guide (Version 7.5.0): In the section on "Domains," the guide explicitly lists the types of data that can be assigned to a domain. It states, "You can assign the following types of data to a domain: Log sources, Log source groups, Flow sources, Flow collectors, Scanners." This directly confirms that Log sources (D) and Flow collectors (C) are assignable. (IBM Security QRadar SIEM Administration Guide, Version 7.5.0, Chapter: "Domains", Section: "Domains").

2. IBM QRadar SIEM Core Functionality Guide (Version 7.5.0): This guide details the flow of data into QRadar. It describes how Event Collectors process logs from log sources and how QFlow Collectors process network packets into flow records. The Domain Management function then uses these defined sources as the basis for data segregation, reinforcing that log sources and flow collectors are the correct entities to assign to a domain. (IBM Security QRadar SIEM Core Functionality Guide, Version 7.5.0, Chapter: "QRadar SIEM components", Section: "Event and flow pipelines").

The notification "MPC: Unable to create new offense. The maximum number of active offenses has been reached" is generated by the Magistrate Processing Component (MPC) in QRadar. This occurs when the number of open, active offenses meets a predefined system limit, which is designed to maintain system performance. The default value for this limit is 2,500 active offenses. When this threshold is reached, QRadar stops creating new offenses until existing ones are closed or the limit is increased by an administrator. This setting is controlled by the OFFENSECREATIONMAXACTIVEOFFENSES parameter in the nva.conf file.

A. 3500: This is not the default configured value for the maximum number of active offenses in QRadar.

B. 1500: This is not the default configured value for the maximum number of active offenses in QRadar.

C. 5000: This is not the default configured value for the maximum number of active offenses in QRadar.

1. IBM QRadar Administration Guide: In the section discussing system settings, the OFFENSECREATIONMAXACTIVEOFFENSES parameter is detailed. The guide specifies, "The default value is 2500. When the number of active offenses reaches the value that is specified by this parameter, a system notification is sent and no new offenses are created." (Reference: IBM QRadar Administration Guide, System Settings chapter, Offense management section).

2. IBM Support Technote KB0021943: This official support document directly addresses the notification in the question. It states, "By default, the maximum number of active offenses is 2,500. When this value is reached, QRadar generates the 'MPC: Unable to create new offense...' notification and stops creating new offenses." (Source: IBM Support, Document Number: KB0021943, "QRadar: 'MPC: Unable to create new offense. The maximum number of active offenses has been reached' notification").

3. IBM Knowledge Center - QRadar on Cloud: The documentation for managing system settings lists various tunable parameters. For OFFENSECREATIONMAXACTIVEOFFENSES, it confirms, "The maximum number of active offenses that can be in the system. Default: 2500." (Source: IBM Knowledge Center, IBM QRadar on Cloud, "Managing system settings").

To map a raw log event to a QRadar Identifier (QID) using the DSM Editor, QRadar requires a unique key. This key is a composite of the Event ID and the Event Category. While official documentation confirms both fields must be specified to create a unique mapping, the Event ID serves as the primary and most specific identifier for an event. It often corresponds directly to a message code or unique name from the source device. The Event Category provides a broader classification. In the context of a single mandatory field, the Event ID is the most fundamental component required to distinguish one event from another.

A. High-level Category: This is a property of the QID record itself, used for categorization and reporting within QRadar, not a field from the log used for the mapping lookup.

B. Low-level Category: Similar to the high-level category, this is a descriptive attribute of the QID, not part of the composite key used to map the event.

C. Event Category: While the Event Category is also a required component of the composite mapping key, the Event ID is considered the primary and more specific identifier for the event.

1. IBM QRadar DSM Configuration Guide (Version 7.5.0), Chapter 10: DSM Editor, Section: "Mapping events", Page 100.

The guide states, "For each event that you want to identify, you must specify an Event ID and an Event Category to create a QID map entry." This confirms that both are required for the composite key, establishing the context that the Event ID is the primary identifier within that pair.

2. IBM QRadar API Reference Guide (Version 7.5.0), Section: qidmap, Endpoint: POST /qidmap/qidmaps.

The API documentation for creating a new QID map entry lists both eventid (string) and eventcategory (string) as "Required" parameters in the request body. This reinforces that both are mandatory from a system standpoint, with eventid being the principal event identifier.

3. IBM Security QRadar SIEM Administration Guide (Version 7.3.1), Chapter 11: Managing event sources, Section: "QID map entries", Page 173.

The documentation explains, "The QID map links an Event ID and an Event Category to a QID." This phrasing highlights the two components that form the link, with the Event ID being the primary name or code for the event being mapped.

The df (disk free) command is the standard Unix/Linux utility for reporting file system disk space usage. It provides a high-level overview of all mounted file systems, showing the total size, used space, available space, and use percentage. The -h (human-readable) flag formats these sizes in an easily understandable way (e.g., KB, MB, GB). This command is the primary tool for quickly verifying overall disk usage levels when diagnosing storage issues on a system like the IBM QRadar appliance, which is built on a Linux-based operating system.

ls -laF: Lists the contents and attributes of files within a directory, not the overall filesystem usage.

lsof -h: Lists files that are currently open by processes; it does not report on disk capacity or usage.

du -h: Summarizes disk usage for specific files and directories, which is useful for finding what is using space, but not for an initial overview of all filesystems.

1. Official Vendor Documentation: In the IBM Security QRadar SIEM documentation, the df -h command is the specified method for checking disk partition usage during troubleshooting. For example, when addressing disk space issues on the /store partition.

Source: IBM. (2023). IBM Security QRadar SIEM Administration Guide (Version 7.5.0). Section: "Troubleshooting system health and performance," Subsection: "Disk space issues." (Note: Specific page numbers vary by document version, but the command is standard in troubleshooting procedures for disk space).

2. University Courseware: Reputable university computer science courses covering operating systems or system administration explicitly teach df for checking filesystem capacity.

Source: Massachusetts Institute of Technology (MIT). (2020). The Missing Semester of Your CS Education. Lecture 2: Shell Tools and Scripting. The course materials differentiate the use of df (for filesystem overview) and du (for directory-specific usage). Available at: https://missing.csail.mit.edu/2020/shell-tools/

3. Official Vendor Documentation (Linux): As QRadar appliances run on Red Hat Enterprise Linux (RHEL), the official RHEL documentation is an authoritative source. The df command is documented as the tool for reporting file system disk space usage.

Source: Red Hat, Inc. (2023). RHEL 8 Managing storage devices. Chapter 2, Section 2.6. "Displaying file system information." The documentation details the usage of df and its options, including -h.

IBM Fix Central is the official and centralized repository for obtaining software updates, patches, and fixes for all IBM hardware and software products, including IBM QRadar. Customers use this portal to find and download specific update packages, interim fixes, and security patches required to maintain their QRadar deployment. It allows users to search for fixes by product, version, and platform, ensuring they can access the correct files to keep their systems secure and up-to-date with the latest enhancements and bug fixes.

B. IBM X-Force Exchange: This is a threat intelligence sharing platform, used for researching security threats and indicators of compromise, not for downloading QRadar product software updates.

C. IBM Passport Advantage Online: This site is used for managing software licenses and downloading the initial, full installation media for entitled IBM products, not for subsequent patches or interim fixes.

D. QRadar 101: This is an unofficial community and learning resource for QRadar users. It is not an official IBM site for software distribution or updates.

1. IBM Support Documentation for QRadar Updates: The release notes for QRadar software updates consistently direct users to IBM Fix Central for downloads. For example, the "IBM QRadar SIEM 7.5.0 Update Package 7" documentation states, "The QRadar 7.5.0 Update Package 7 SFS is available on IBM Fix Central."

Source: IBM Support, "IBM QRadar SIEM 7.5.0 Update Package 7," Document Number: 6954981, Section: "Downloading the 7.5.0 Update Package 7 SFS".

2. IBM Fix Central Homepage: The purpose of the site is explicitly stated on its main page.

Source: IBM Support, "Fix Central," (https://www.ibm.com/support/fixcentral), Page Description: "Fix Central provides fixes and updates for your system's software, hardware, and operating system."

3. IBM Passport Advantage Online Overview: This official page describes the function of Passport Advantage, which is focused on entitlement and initial software downloads.

Source: IBM, "Passport Advantage Online for Customers," (https://www.ibm.com/software/passportadvantage/paocustomer.html), Section: "Key features". This section details features like "Download software" and "View proof of entitlement," which pertain to base product acquisition.

The IBM QRadar quick filter uses a specific syntax for complex queries involving boolean logic and special characters. To combine multiple search criteria with a logical AND, the terms must be enclosed in double quotes (") and separated by the %AND% operator. The asterisk () is the correct wildcard character to match any value in the last octet of the IP address. This syntax ensures that the filter returns only the results that contain all three specified elements: the IP address pattern, "BlueCoat", and "TCPREFRESHMIS".

A. (10.100.100.- Bluecoat TCPREFRESHMIS)

This syntax is incorrect. The hyphen (-) is not a valid logical operator, and the lack of quotes and a proper AND operator will not produce the intended results.

B. 10.100.100.%Bluecoat%TCPREFRESHMIS

This is incorrect because the percent sign (%) by itself is not a logical operator in QRadar's quick filter; it is part of the %AND% or %OR% keywords.

D. (10.100.100/ AND Bluecoat AND TCPREFRESHMIS)

This syntax is invalid. The forward slash (/) is used for CIDR notation (e.g., 10.100.100.0/24) to specify a network range, not as a wildcard for a partial IP address.

---

1. IBM QRadar SIEM User Guide (Version 7.5.0).

Section: "Searching and filtering data" -> "Quickly filtering log and network activity"

Content: This section details the syntax for quick filters. It explicitly states, "To search for a text string that includes spaces, ampersands, or other special characters, enclose the string in double quotation marks." It also provides examples of using boolean operators like %AND%, %OR%, and %NOT% within the quoted string to combine search terms. For instance, a search for "source ip%AND%destination ip" is shown as a valid example. This directly supports the structure used in the correct answer.

In the IBM QRadar architecture, the Event Processor is the core component responsible for processing, correlating, and storing event data. The event data is written to the Ariel database, which resides on the Event Processor appliance. To scale storage capacity and improve search performance, Data Nodes can be attached to an Event Processor. When a Data Node is connected, the event data is distributed and stored across both the Event Processor and the attached Data Node(s), effectively expanding the storage pool for that processor.

A. Event Collectors are responsible for gathering and parsing logs, then forwarding the normalized data to an Event Processor. They do not perform long-term storage in the Ariel database.

B. Data Gateways are primarily used for data collection from various sources, similar to Event Collectors, and do not host the Ariel database for event storage.

D. App Hosts are dedicated managed hosts for running QRadar applications. They are isolated from the core data collection, processing, and storage pipeline and do not store event data.

1. IBM QRadar SIEM Administration Guide (Version 7.5.0): In the section "QRadar components," the role of the Event Processor is defined: "The Event Processor processes events... The event data is stored on the Event Processor." The guide further explains Data Nodes: "When data is written, it is automatically distributed among the Event or Flow Processor and any attached Data Nodes." This directly supports that data is stored on the Event Processor and its attached Data Node.

Source: IBM Documentation, "QRadar components," IBM QRadar SIEM Administration Guide, Version 7.5.0.

2. IBM Security QRadar SIEM Architecture Document: This document outlines the roles of different appliances. It states, "The Event Processor is responsible for processing events and storing them to disk." Regarding Data Nodes, it clarifies, "A Data Node is a managed host that is dedicated to storing event and flow data. Data Nodes are attached to an Event Processor or Flow Processor to increase the data storage capacity of the processor."

Source: IBM Security QRadar SIEM Architecture, Fourth Edition (October 2016), Page 10 ("Event Processor") and Page 12 ("Data Node").

3. IBM QRadar Data Sheet: The official data sheet describes the function of Data Nodes as a way to "add storage and processing capacity on demand" to Event and Flow Processors, confirming their role as a storage extension for the processor.

Source: IBM Security QRadar SIEM Data Sheet, Document Number: TSD03388-USEN-04, Page 3 ("Scale storage and processing with data nodes").

When viewing or exporting event search results from the IBM QRadar Log Activity tab, the default columns are configured to provide a concise, high-level summary for an initial investigation. The columns listed in option A—Log Source, Event Count, High Level Category, and Related Offense—are fundamental to this initial analysis. Log Source identifies the origin, Event Count shows the frequency (especially in grouped views), High Level Category classifies the event type, and the Related Offense column indicates if the event is correlated into a security offense. While the complete default view includes other columns, this combination represents the most accurate and functionally relevant set among the choices.

B. 'Application' and 'Username' are not default columns. They are valuable for specific investigations but must be manually added to the view as they are not universally present in all log types.

C. 'Username' and 'Source Port' are not part of the default column set. These are specific event properties that an administrator would typically add for a more granular investigation.

D. 'Protocol', 'Storage Time', 'Destination Port', and 'Source Port' are all non-default columns that provide specific network or metadata details and are not included in the default summary view.

1. IBM QRadar SIEM User Guide (Version 7.5.0), Chapter 6: "Investigating events", Section: "Event investigation columns", Page 62. This section details the columns available in the Log Activity tab, noting that the default display includes columns "commonly used for event investigations," such as Log Source, Event Count, and category information. The presence of an offense indicator is also a standard UI element.

2. IBM Security Learning Academy, Course BQ103G: IBM QRadar SIEM Foundations, Unit 5: "Investigating an Offense Triggered by Events". The lab exercises and user interface demonstrations in this official course consistently show Log Source, Event Count, and Category information as primary columns in the default Log Activity view. The link between events and offenses is a core concept, making the Related Offense information a key default element.

To configure IBM QRadar for automatic geographic data updates from MaxMind, the geoipupdate.sh script is used. This script reads its configuration from the /opt/qradar/conf/geoipupdate.conf file. According to the official IBM QRadar documentation, this configuration file requires two specific credentials from the MaxMind account: the ACCOUNTID (corresponding to Account/User ID) and the LICENSEKEY. These two values are used to authenticate with the MaxMind servers and authorize the download of the GeoIP2 or GeoLite2 database files.

B. API key: The MaxMind geoipupdate service, used by QRadar, specifically requires a "License Key" for authentication, not a generic "API key".

D. MaxMind username: Authentication is not based on a user's login name but on the numeric Account ID assigned by MaxMind.

E. API password: The authentication mechanism for the geoipupdate service does not use a password; it relies on the combination of the Account ID and License Key.

1. IBM QRadar Administration Guide (Version 7.5.0): In the section "Configuring automatic updates for geographic data," the procedure explicitly states: "In the /opt/qradar/conf/geoipupdate.conf file, set the values for ACCOUNTID and LICENSEKEY to the values that you get from your MaxMind account." This directly supports the requirement for both an Account ID and a License Key.

2. MaxMind Developer Documentation: The official documentation for the geoipupdate program, which QRadar utilizes, specifies the required credentials. In the "Download and Update Databases with geoipupdate" guide, it states, "You will need your Account ID and a License Key to use geoipupdate." The sample configuration file shown also includes the fields AccountId and LicenseKey. (Reference: https://dev.maxmind.com/geoip/geoipupdate/)

The recon connect command is a specific utility within the IBM QRadar App Framework command-line interface (CLI). Its designated purpose is to establish a connection to a running application container and execute a command within it. The container can be targeted using its unique application ID or by specifying its workload, service, and container name, directly matching the functionality described in the question.

A. ifconfig -a: This is a standard Linux command used to display information about network interfaces. It does not interact with QRadar application containers.

B. recon ps: This command lists the running QRadar application containers, similar to the docker ps command, but it does not execute commands inside them.

D. yum info: This is a standard Linux command for the YUM package manager, used to display information about software packages. It is unrelated to QRadar app management.

---

1. IBM QRadar SIEM Administration and Configuration Guide (V7.5.0):

Section: "Managing apps by using the recon command-line utility"

Content: This section explicitly details the usage of the recon tool. It states, "Use the connect command to run a specific command inside of a specific container, when given an app ID, or a combination of workload, service, and container." This directly confirms that recon connect is the correct command for the described task. The guide also describes recon ps as the command to "list all of the running containers on the system," differentiating its function from recon connect. (This information is found in the official product documentation for QRadar V7.5.0).

2. IBM Security Learning Academy - Course: IBM Security QRadar SIEM 7.5 Administration (BQ106G):

Module: "QRadar App Framework Administration"

Content: The courseware for QRadar administration covers command-line tools for troubleshooting and managing applications. The recon utility is highlighted, with recon connect being presented as the primary method for interacting with the shell of a running app container to perform diagnostics or execute commands.

The License Pool Management section in the QRadar Admin tab is the designated interface for managing and monitoring license allocations across all hosts in a deployment. This screen provides a comprehensive table view of each host's license capacity, current usage, and other key metrics. The "License Giveback" rate, which indicates the amount of unused license capacity a host is returning to the shared pool, is explicitly displayed as a column in this table for each applicable host.

A. The "System Settings" section contains general system-wide configurations, but the specific, detailed license allocation and giveback metrics are located in the dedicated "License Pool Management" area.

B. Ariel Query Language (AQL) is used for searching and analyzing event and flow data stored in the Ariel database, not for querying internal system configuration or license metrics.

D. The Log Activity tab is for viewing and analyzing security events. While license-related system notifications might appear here, it is not the correct tool for monitoring a specific metric like the giveback rate.

1. IBM QRadar SIEM Administration Guide: In the section on license management, the guide details the "License Pool Management" window. It states, "Use the License Pool Management window to manage the EPS and FPM license allocations for each host in your deployment." The interface described explicitly includes columns for monitoring license giveback. (Reference: IBM Documentation, QRadar SIEM, Administering QRadar > System settings > License management > License pool management).

2. IBM QRadar SIEM Core Functionality Guide: This guide explains the concept of shared license pools and the giveback feature. It directs administrators to the Admin tab and the License Pool Management icon to view and configure these settings, confirming it as the location to see the giveback status and rate. (Reference: IBM Documentation, QRadar SIEM, Core Functionality > Data collection > Event and flow processing > Shared license pools).

The IBM QRadar Server Discovery function is designed to automatically identify servers and their roles (e.g., web server, mail server, DNS server) on a network. This process involves analyzing network traffic and other data sources. All the information gathered about these discovered servers, including their services, open ports, and server classification, is populated into and stored within the Asset Profile Database. This database acts as the central repository for comprehensive information about all known assets on the network, which is essential for correlation rules, reporting, and incident investigation.

A. Flow profile database: The flow database stores raw network session data (flows), which is a source for discovery, but it is not the profile database where consolidated asset and server information is stored.

B. Network profile database: This is a generic term. The specific and correct name for the database that stores host and server information in QRadar is the Asset Profile Database.

C. Domain profile database: This database stores information related to network domains and their assets. While related, it is a component of the broader Asset Profile Database, which is the primary answer.

1. IBM QRadar SIEM Documentation, "Server discovery": "IBM QRadar automatically discovers servers on your network and adds them to the asset profile database. QRadar uses passive flow data and vulnerability data to identify servers on your network."

Source: IBM QRadar SIEM Documentation, Section: Asset profiles, Subsection: Server discovery.

2. IBM QRadar SIEM Documentation, "Asset profile overview": "The asset profile database is populated by identity information that is learned from event and flow data... QRadar automatically discovers servers on your network and adds them to the asset profile database."

Source: IBM QRadar SIEM Documentation, Section: Asset profiles, Subsection: Asset profile overview.