Twenty-four percent is the largest single share of the IBM QRadar SIEM analysis exam, and it does not belong to offense analysis. It belongs to threat hunting. That one figure tells you more about C1000-162 than the exam title does, because the credential is named IBM Certified Analyst – Security QRadar SIEM V7.5, and most candidates read “analyst” as “the person who works the offense queue”.
The syllabus disagrees. Offense analysis carries 23 percent. Threat hunting carries 24 percent, and searching and reporting carries another 21 percent. Put those two together and 45 percent of the paper is about what you do once you stop trusting the offense list: writing Ariel Query Language searches, reading payloads, and separating a real indicator from a noisy rule. This guide walks the five weighted domains as IBM’s published syllabus names them, sets out the exam mechanics, and settles the question that sends most people to the wrong exam entirely, which is whether you should be sitting the analysis paper at all.
What Does the IBM QRadar SIEM Analysis Exam Test?
C1000-162 tests whether you can work an investigation inside IBM QRadar SIEM V7.5 rather than describe how the product is built. Across 64 questions in 90 minutes, it asks you to triage offenses, read the rules and building blocks that created them, hunt through events and flows with Ariel searches, and turn what you find into dashboards and reports.
That framing matters because QRadar has three separate credentials, and only this one sits in the investigation seat. Deployment questions, appliance sizing and licence management belong elsewhere. Here the console is already running, the log sources are already feeding it, and the question is what you do with the alert in front of you.
QRadar itself is IBM’s threat detection platform, and its central idea is correlation: raw events and network flows are matched against rules, and the matches are collapsed into prioritised offenses so an analyst is not reading a firehose. IBM sets out that architecture on its QRadar SIEM product page. The exam assumes you accept that model and can operate inside it under pressure.
A useful way to read the objective list is to notice what the verbs are. The syllabus asks you to triage, analyse, recognize, distinguish, investigate and recommend. It rarely asks you to define. Questions are written as scenarios with a console state attached, and the correct answer is usually the next investigative step rather than a fact about the product.
How Are the Five C1000-162 Domains Weighted?
The published syllabus splits C1000-162 into five weighted domains: Threat Hunting at 24 percent, Offense Analysis at 23 percent, Searching and Reporting at 21 percent, Rules and Building Block Design at 18 percent, and Dashboard Management at 14 percent. Nothing dominates, which means no single area can be skipped and passed around.
| Domain | Weight | Approximate questions | What it is really asking |
|---|---|---|---|
| Threat Hunting | 24% | 15 | Can you find something the rules did not flag |
| Offense Analysis | 23% | 15 | Can you work the queue the rules did produce |
| Searching and Reporting | 21% | 13 | Can you evidence and communicate what you found |
| Rules and Building Block Design | 18% | 12 | Can you read why the console behaved as it did |
| Dashboard Management | 14% | 9 | Can you build the view a team works from |
The question counts are derived from the weightings against a 64-question paper, so treat them as planning figures rather than a guarantee. Their value is in showing how flat the distribution is. Dashboard Management is the smallest domain and still accounts for roughly nine questions, which is more than the six-question margin between a 64 percent pass and a fail.
Working through QRadar analysis sample questions against a live console is the fastest way to find which of the five you are weakest in, because the gap tends to show up as hesitation rather than as a wrong answer.
Why a flat distribution changes your study plan
On an exam with a 40 percent domain, you protect the big one and accept losses elsewhere. C1000-162 does not allow that. With the largest domain at 24 percent, a candidate who is fluent in four areas and blank in the fifth is losing between nine and fifteen marks before answering a single question they know.
What Are the C1000-162 Exam Details?
C1000-162 is a 64-question exam with a 90-minute limit and a 64 percent pass mark, priced at 200 US dollars and delivered through Pearson VUE. Ninety minutes across 64 questions works out at roughly 84 seconds each, which is comfortable for recall items and tight for a scenario that hands you a screenshot of an offense summary.
| Detail | Value |
|---|---|
| Certification name | IBM Certified Analyst – Security QRadar SIEM V7.5 |
| Exam code | C1000-162 |
| Questions | 64 |
| Duration | 90 minutes |
| Passing score | 64% |
| Price | $200 USD |
| Delivery | Pearson VUE |
A 64 percent pass mark on 64 questions means 41 correct answers. That is a wider margin than many security exams allow, and it is the reason a candidate with genuine console experience and one weak domain can still pass. It is not wide enough to survive two weak domains.
Scheduling runs through the standard IBM route at Pearson VUE for IBM exams, with the usual choice between a test centre and online proctoring. The product version in the title is not decoration: the objectives are written against QRadar SIEM V7.5, and console layouts have shifted enough across releases that rehearsing on an older build teaches menu paths you will not be shown.
Which of the Three QRadar Exams Should You Sit?
IBM publishes three QRadar SIEM V7.5 credentials, and they are not a difficulty ladder. C1000-175 covers foundations, C1000-162 covers analysis, and C1000-156 covers administration. They describe three different jobs, so the right choice follows what you are asked to do on a Monday morning rather than how long you have been doing it.
| Exam | Credential focus | Who it fits |
|---|---|---|
| C1000-175 | Foundations of QRadar SIEM V7.5 | Newcomers proving they can navigate the console at all |
| C1000-162 | Analysis | Analysts who investigate offenses and hunt through events |
| C1000-156 | Administration | Engineers who own log sources, tuning and platform health |
The confusion is usually between the first two. If your day is spent in the offense queue and the log activity tab, analysis is your exam. If you are still learning where the offense summary lives, the foundations credential is the honest starting point, and our QRadar security associate guide covers what that tier expects before you commit 200 dollars to the analysis paper.
Administration is the one people sit by accident. Its search demand runs close to the analysis exam, and the titles look similar enough that candidates book on the wrong code. If your responsibilities include adding log sources, managing deployment health or handling licences, that is the correct paper. If they do not, the administration objectives will read as a syllabus for somebody else’s job.
What Does Offense Analysis Look Like in Practice?
Offense analysis is 23 percent of C1000-162, and it covers the whole life of an alert: triaging the initial offense, reading which rules matched fully and which matched only in part, following the associated IP addresses, interpreting magnitude, and closing the offense out through offense management. It is the queue-work half of the analyst role.
Two objectives in this domain catch experienced people out. The first is the distinction between fully matched and partially matched rules. An offense raised by a partial match is a different investigative problem from one raised by a complete match, and the syllabus expects you to say which you are looking at and what that implies about confidence.
The second is magnitude. It is easy to treat it as a severity score and move on, but it is a composite, and the exam asks you to describe what it is actually made of and why two offenses with the same event count can carry different magnitudes.
MITRE mapping is a named objective
The syllabus lists “recognize MITRE threat groups and actors” as an Offense Analysis objective, which makes threat-actor attribution part of the exam rather than background reading. The MITRE ATT&CK groups index is the reference the industry works from, and it is worth being able to move from a technique seen in an offense to the groups that habitually use it.
Alongside that sit the quieter objectives: identifying stored and unknown events and where they came from, outlining offense naming mechanisms, and creating customized searches from inside an offense. None of them is difficult. All of them are the kind of thing you have clicked through a hundred times without ever articulating.
Why Is Threat Hunting the Heaviest Domain?
Threat hunting is 24 percent of C1000-162 because it is where analysis stops being reactive. The domain covers Ariel Query Language searches, event and flow parameter investigation, time-series searches, indicator analysis, payload inspection, right-click investigations, and the judgement call that separates a probable false positive from something worth escalating.
AQL is the piece most candidates underprepare. The syllabus asks you to perform an AQL query, not to recognise one, and the difference shows in scenario questions that give you a hunting goal and four query fragments. Reading AQL fluently is a different skill from writing it, and only one of them survives exam conditions.
Payload work is the other underweighted objective. Two separate items ask you to investigate the payload for additional detail and to recommend new custom properties based on what the payload contains. That second one is a design decision dressed as an analysis question: you are being asked whether a field you keep extracting by hand should become a property the console extracts for everyone.
IBM’s own QRadar 7.5 documentation is the right reference for query syntax and property behaviour, and it is worth reading the Ariel sections against a console rather than on their own.
Rules and building blocks sit underneath the hunt
Rules and Building Block Design is a smaller domain at 18 percent, but it is the one that explains the other four. Reading a regular expression test, understanding reference sets and how they are populated, recognising when a Content Pack is the answer, and knowing your network hierarchy are all things you need before you can say why an offense fired. Behavioral, anomaly and threshold rules each fail in a characteristic way, and the exam expects you to name which is which.
How Should You Prepare for C1000-162?
Preparation for C1000-162 works best as a four-stage sequence built around a live QRadar console rather than a reading list. The order matters: rules and building blocks explain offenses, offenses generate the hunts, and hunts produce the searches and reports, so studying them out of sequence means learning each one without its context.
- Rebuild your console fluency first. Spend a week inside log activity, network activity and the offense tab until you can reach any of them without thinking, and read your own deployment’s network hierarchy end to end.
- Work the rules layer next. Open the rules that fire most often in your environment, read their tests, trace the building blocks they depend on, and populate a reference set by hand so the mechanics are yours rather than remembered.
- Move to offense work and hunting together. Triage real offenses, follow each one to the rule that raised it, then leave the offense behind and hunt the same activity with AQL from scratch until the query comes without reference.
- Finish with searching, reporting and dashboards under a clock. Build a threat report from an offense, export results, schedule a report, and assemble a dashboard in both the classic view and Pulse, then run a timed set of practice items with no console open.
The last stage is the one people skip, and it is the one the weightings argue for hardest. Searching and reporting plus dashboard management together are 35 percent of the paper, which is more than threat hunting and more than offense analysis. They are also the least glamorous parts of the job, which is exactly why they go unrehearsed.
For a checklist of what the exam covers before you start, the site’s C1000-162 exam overview lays the objectives out in the order IBM publishes them, which is a useful audit sheet to score yourself against at the end of each stage.
What Skills Does Passing This Exam Prove?
Passing C1000-162 proves you can take an alert from a QRadar console to a defensible conclusion without help. Concretely, that means triaging an offense against its originating rules, hunting the same activity independently with Ariel searches, judging an indicator against a false positive, and producing a report a manager or an auditor can read.
Those are transferable claims. The console is IBM’s, but the reasoning is platform-neutral: correlation rules, reference sets, network hierarchies and query languages exist in every serious SIEM under different names. An analyst who can explain why a partially matched rule raised an offense is describing a way of thinking, not a menu path.
The credential also carries a specific signal about scope. It says you sit on the investigation side rather than the platform side, which is a genuinely useful thing for a hiring manager to know in advance. Roles that split SOC analysis from SIEM engineering read the three QRadar codes precisely for that reason.
One caution worth stating plainly. The certification is versioned to QRadar SIEM V7.5, and IBM’s security portfolio has been moving toward a broader suite. A version-bound credential proves current fluency rather than permanent standing, so treat it as evidence of what you can do now and keep the underlying investigative skill portable.
Frequently Asked Questions
How many questions are on the C1000-162 exam?
Sixty-four questions in 90 minutes. That is roughly 84 seconds per question, which is enough for recall items but tight for the scenario questions that present an offense summary and ask for the next investigative step.
What is the passing score for C1000-162?
Sixty-four percent, which works out at 41 correct answers from 64. The margin is wide enough to absorb one weak domain but not two, and the domains are weighted flatly enough that no single area can be skipped.
How much does the IBM QRadar certification cost?
Two hundred US dollars for C1000-162, scheduled through Pearson VUE. The fee is per attempt, so the practical cost of an unprepared sitting is 400 dollars rather than 200.
What is the difference between C1000-162 and C1000-156?
C1000-162 is the analysis exam and C1000-156 is the administration exam. Analysis covers investigating offenses and hunting through events. Administration covers owning the platform itself, including log sources, tuning and deployment health.
Which QRadar domain carries the most marks?
Threat Hunting, at 24 percent. Offense Analysis follows at 23 percent, then Searching and Reporting at 21, Rules and Building Block Design at 18, and Dashboard Management at 14 percent.
Do I need to write AQL for the C1000-162 exam?
Yes. Performing an AQL query is a named Threat Hunting objective, not an optional extra. Scenario questions give a hunting goal and candidate query fragments, so reading AQL fluently is not sufficient on its own.
Does the QRadar analysis syllabus include MITRE threat groups?
Yes. Recognising MITRE threat groups and actors is listed as an Offense Analysis objective, so being able to move from an observed technique to the groups that commonly use it is inside the exam scope.
What QRadar version does the exam cover?
QRadar SIEM V7.5. Console layouts and property behaviour have shifted across releases, so practising on an older build risks learning navigation paths that will not match what the exam describes.
How long should I spend preparing for C1000-162?
Around four weeks is a realistic block for someone already working in a QRadar console, split across console fluency, the rules layer, offense and hunting work together, and a final timed stage on searching, reporting and dashboards.
Is C1000-162 suitable for a complete QRadar beginner?
Not really. The objectives assume you can already navigate the console and read an offense summary. C1000-175, the foundations credential, is the honest starting point if the offense tab is still unfamiliar territory.
Conclusion
The IBM QRadar SIEM analysis exam is not the offense-queue exam its title suggests. Threat hunting is the heaviest domain at 24 percent, searching and reporting takes another 21, and together with dashboards that is well over half the paper spent away from the alert list. C1000-162 gives you 64 questions, 90 minutes and a 64 percent pass mark to show you can investigate rather than react.
Audit yourself against the five weighted domains, be honest about which of the three QRadar credentials matches the job you actually do, and rehearse AQL and reporting on a live console rather than on paper. The domain table above is worth returning to until none of the five reads as unfamiliar territory.
