- The Exam at a Glance: What You Are Actually Being Measured On
- How the Five Domain Weights Compare
- Domain 3: Threat Hunting (24%)
- Domain 1: Offense Analysis (23%)
- Domain 5: Searching and Reporting (21%)
- Domain 2: Rules and Building Block Design (18%)
- Domain 4: Dashboard Management (14%)
- Scope Boundaries: Prior Knowledge, Included Apps and Exclusions
- Question Styles You Will Meet
- Sequencing Your Preparation Around the Domains
- Registration and Delivery Mechanics
- Frequently Asked Questions
- C1000-162 is IBM Security QRadar SIEM V7.5 Analysis: 64 questions, 90 minutes, and 41 correct answers needed to pass.
- Threat Hunting (24%), Offense Analysis (23%) and Searching and Reporting (21%) together carry roughly 68% of the exam.
- The guide targets V7.5 Update Package 5; QRoC SaaS and app-specific functions beyond the included apps are out of scope.
- Question formats include single-answer, multiple-answer and ordering tasks, with hot-area items flagged in exam metadata.
The Exam at a Glance: What You Are Actually Being Measured On
The C1000-162 exam, titled IBM Security QRadar SIEM V7.5 Analysis, is the required exam for the IBM Certified Analyst - Security QRadar SIEM V7.5 credential (credential code C9005200). It is issued through IBM Professional Certification and is delivered in English. The exam presents 64 questions in 90 minutes, and the passing requirement is expressed as an exact count: 41 correct answers. For a deeper look at how that threshold plays out, see our breakdown of the C1000-162 passing score.
The word "Analysis" in the title matters. This is an analyst-level exam, not an installation or administration exam. Candidates are measured on what they do inside a working QRadar deployment: investigating offenses, writing and tuning rules, hunting for threats, building searches and reports, and managing dashboards. Some third-party sites label this exam code as an administration or cloud architecture credential. IBM's own record identifies it as the QRadar SIEM V7.5 Analysis exam, and that is the identity this guide follows. If you want a plain-language orientation first, What Is C1000-162? covers the basics.
IBM publishes five formal exam objectives with approximate weights. The study guide is 34 pages and the official sample question document is 12 pages. Both are worth reading in full before you build any plan, because the guide specifies the product baseline: V7.5 Update Package 5.
How the Five Domain Weights Compare
The weights are approximate, published by the issuer, and they tell you where the scoring mass sits. They do not tell you exactly how many questions come from each domain on your particular form.
| Domain | Approx. Weight | Character of the Domain |
|---|---|---|
| Domain 3: Threat Hunting | 24% | Investigative, search-driven, ATT&CK-aware |
| Domain 1: Offense Analysis | 23% | Triage and interpretation of offenses |
| Domain 5: Searching and Reporting | 21% | Query construction, filters, report output |
| Domain 2: Rules and Building Block Design | 18% | Detection logic and reusable test components |
| Domain 4: Dashboard Management | 14% | Visualization and workspace configuration |
Notice that three domains sit in a narrow band between 21% and 24%. That is why candidates who over-invest in one of them often get surprised. A weak spot in any of the top three costs more than a weak spot in Dashboard Management. Our guide on how hard the C1000-162 exam is discusses where analysts tend to feel pressure.
Domain 3: Threat Hunting (24%)
Threat Hunting is the largest domain, and it is the one that most separates a console operator from an analyst. It rewards candidates who can move from a hypothesis to evidence using QRadar's data.
What Threat Hunting Demands
You must be able to use QRadar's search and investigation capabilities proactively rather than waiting for an offense to appear.
- Form a hunting hypothesis from an attack technique, then translate it into events, flows and filters you can actually run.
- Relate observed behavior to MITRE ATT&CK tactics and techniques, since attack types including ATT&CK are listed as foundational knowledge.
- Pivot between related data: from an event to the source and destination assets, then to other activity involving those assets.
- Recognize which findings justify escalation and which are benign noise.
- Understand how QRadar's included apps support investigation work, particularly QRadar Assistant and Pulse as listed in the scope.
Because this domain leans on browser fluency and RegEx skills (both named as prior knowledge), practice extracting custom properties and writing patterns that match real log payloads. A hunting question might hand you a payload snippet and ask which pattern or filter isolates the suspicious activity.
Domain 1: Offense Analysis (23%)
Offense Analysis is the heart of day-to-day SOC work in QRadar. An offense aggregates related events and flows into a single investigable object, and the exam expects you to read one the way a Tier 1 or Tier 2 analyst would.
Core Offense Skills
Expect scenario questions that present an offense and ask what you should conclude or do next.
- Interpret offense summaries: magnitude components, contributing rules, offense source and the category of activity involved.
- Examine the events and flows that triggered the offense, and determine whether they represent a true positive.
- Use offense management actions such as assigning, annotating, following, protecting, closing and hiding, and know when each is appropriate.
- Identify the data an analyst needs to document findings for handoff or escalation.
Domain 5: Searching and Reporting (21%)
This domain is about getting precise answers out of QRadar and presenting them. It is technical and rewards hands-on repetition more than reading.
Searching and Reporting Essentials
Candidates need fluency in building, saving and reusing searches, then turning results into reports.
- Construct event and flow searches with the right filters, time ranges and grouping, and know when to use quick filters versus advanced searches.
- Use AQL-style thinking where relevant: selecting fields, applying conditions and aggregating results.
- Create, schedule and distribute reports, and choose appropriate chart types and content for different audiences.
- Manage saved search criteria and understand how search results feed other features.
A common trap is confusing what a search returns with what a report presents. Practice moving the same data through both and noticing what changes. Our C1000-162 cheat sheet is a handy place to review the quick-reference items once you have done the hands-on work.
Domain 2: Rules and Building Block Design (18%)
At 18%, this domain is mid-weight but conceptually dense. It covers how QRadar detects behavior and how that detection logic is structured for reuse.
Rules and Building Blocks
You need to distinguish what a rule does from what a building block does, and how they combine.
- Explain the role of building blocks as reusable tests that classify events, flows or assets without generating offenses on their own.
- Read and reason about rule tests, thresholds, time windows and conditions, including how rules respond to the same data.
- Understand rule responses such as creating or adding to offenses, dispatching notifications and updating reference data.
- Recognize how reference sets and other reference data support detection logic.
- Appreciate the role of Use Case Manager, which is an included app in scope, in mapping rules to use cases and frameworks.
Ordering questions are a natural fit here. You might be asked to arrange the steps for building a rule or sequencing the logic of a test. Practice articulating the order in which QRadar evaluates and acts on conditions.
Domain 4: Dashboard Management (14%)
Dashboard Management is the smallest domain, which makes it tempting to skim. Resist that. On a 64-question exam where 41 correct answers are required, a few easy points here can protect your margin.
Dashboard Skills
The focus is on configuring and using the dashboard workspace to monitor activity.
- Create and organize dashboards and add the right items to support monitoring goals.
- Configure dashboard items, including saved search-based items and time-series content.
- Understand how Pulse, an included app, extends visualization and monitoring.
- Match dashboard design to audience and purpose, such as an operational view versus a management view.
Scope Boundaries: Prior Knowledge, Included Apps and Exclusions
One of the most useful parts of the official guide is its separation of what you should already know from what is actually measured. Mixing these up wastes study time.
Foundational Knowledge (Not Directly Measured)
IBM lists TCP/IP, IT security fundamentals, browser and RegEx skills, and an understanding of attack types including MITRE ATT&CK as prior knowledge. Separately licensed features such as Network Insights and Incident Forensics are also noted in this context. Treat these as the floor you stand on, not as the exam objectives themselves. The five domains are the formal objectives.
Included Apps
The scope includes Use Case Manager, QRadar Assistant, Log Source Manager and Pulse. App extensibility is also in scope.
Explicit Exclusions
Other app-specific functions and QRadar on Cloud (QRoC) SaaS are excluded. If you are studying a QRoC-specific workflow or an app outside the four named above, you are likely over-reaching. Confirm requirements and prerequisites in our C1000-162 requirements guide; note that no prerequisite exam is listed for this credential.
| Category | Items | Study Priority |
|---|---|---|
| Formal objectives | The five domains | Highest |
| In-scope apps | Use Case Manager, QRadar Assistant, Log Source Manager, Pulse, plus app extensibility | High |
| Assumed background | TCP/IP, IT security, browser and RegEx, attack types and ATT&CK | Refresh as needed |
| Excluded | QRoC SaaS, other app-specific functions | Skip |
Question Styles You Will Meet
The official sample demonstrates three recognizable formats: single-answer multiple choice, multiple-answer multiple choice, and an ordering or build-list task. Exam metadata additionally flags hot-area items, though IBM does not specify the mix on any individual exam form. Expect variation rather than a fixed ratio.
- Single-answer: Choose the one best option. Read for qualifiers like "first," "best" or "most likely."
- Multiple-answer: Select all that apply, often where the stem tells you how many to choose. Evaluate each option independently.
- Ordering/build-list: Arrange steps in sequence. These reward procedural memory of how QRadar tasks are performed.
- Hot-area: Identify the correct location in an interface image.
Sequencing Your Preparation Around the Domains
The domains build on one another, so order matters more than hours. Here is a domain-driven sequence that matches how the skills depend on each other. For a broader plan, see the C1000-162 study guide.
Searching and Reporting groundwork
- Build event and flow searches until filters and time ranges are automatic.
- Practice RegEx against real payload samples, since hunting depends on it.
Rules and Building Block Design
- Study how building blocks feed rules and how responses create offenses.
- Explore Use Case Manager to connect rules to ATT&CK techniques.
Offense Analysis
- Work through offenses end to end: summary, contributing events, disposition and documentation.
Threat Hunting and Dashboards
- Run hypothesis-driven hunts across searches and offenses.
- Configure dashboards and Pulse views last, then take timed mixed-domain practice.
The logic: searching skills underpin hunting and offense work, rule knowledge explains why offenses appear, and hunting is easiest once the first three layers are solid. Dashboards go last because they depend on saved searches you have already built.
Registration and Delivery Mechanics
The exam is proctored and computer-based, delivered through Pearson VUE. Availability of test-center and online (OnVUE) delivery depends on the selected exam and your country. OnVUE requires a system check, matching photo ID and a private testing space, and books and notes are prohibited.
On cost, an issuer review records an indicative U.S. list fee of USD 200, and the current exam record confirms a price field of 200 without a currency label. Treat the fee as indicative and verify at checkout, since regional pricing and taxes can differ. Our C1000-162 certification cost breakdown and exam dates and scheduling guide cover the logistics in more depth. IBM lists the exam and credential as live, with status verified on 20 October 2026.
Frequently Asked Questions
The exam has 64 questions with a 90-minute time limit. IBM's passing requirement is 41 correct answers. No issuer-published population pass rate has been verified, so be cautious of any site quoting one.
Threat Hunting (24%), Offense Analysis (23%) and Searching and Reporting (21%) are the three largest. Because their weights are close, avoid neglecting any of them, and remember Rules and Building Block Design (18%) still carries meaningful weight.
No. The scope is V7.5 Update Package 5 and includes Use Case Manager, QRadar Assistant, Log Source Manager and Pulse, along with app extensibility. QRoC SaaS and other app-specific functions are excluded.
No prerequisite exam is listed. IBM does describe foundational knowledge such as TCP/IP, IT security, browser and RegEx skills, and attack types including MITRE ATT&CK, but these are assumed background rather than measured objectives.
It signals hands-on QRadar analysis skill to employers running or hiring for QRadar-based SOCs. For roles and outlook, see the C1000-162 jobs overview and the ROI analysis.