EMT Practice Test

1. Question Content...

---

Question1: Which event QID test is used to send an email as a rule response when disk usage reaches a threshold?

Question2: A custom rule is generating events reporting that a specific user is failing to login too many times in the last 5 minutes. The administrator opens the event details to investigate the anomaly associated with the events but finds that no Anomaly details pane is shown.
What is the reason?
The events were generated by:

Question3: An administrator has been tasked to run all health checks at once using the DrQ command before a major event happens, such as an upgrade.
What does the DrQ command do?

Question4: An administrator needs to extract a property from an intrusion detection system (IDS) log. Using a regular expression, the administrator wants to extract a specific part of the log showing the matching "policy ID" of the IDS.
Which type of property must the administrator create?

Question5: An administrator needs to restore from backup the applications in QRadar.
Which configuration item should the administrator select?

Question6: An administrator logs into the QRadar Console to review the stored backup files. There is an exclamation mark beside some files.
What is the cause of this?

Question7: An administrator would like to extend the functionality of QRadar using an external application.
Which file format is supported to successfully upload an application from the QRadar Console?

Question8: A QRadar user reported the following notification:
38750099 - The accumulator was unable to aggregate all events/flows for this interval When does this message appear?

Question9: An administrator has reviewed the list of new features in the QRadar V7.3.2 release notes, and decides to upgrade their system to this version.
What is the minimum supported version that the administrator can upgrade from?

Question10: Which event routing rule is required to add QRadar Data Store (QDS) capability to a deployment?

Question11: An administrator has to change the system hardware clock of the QRadar server. The administrator has already restarted the main services (hostservices, tomcat, hostcontext) and needs to synchronize the QRadar Console time with the QRadar managed hosts.
Which command can the administrator use to accomplish this?

Question12: An administrator needs data backup.
What information is contained in the data backup?

Question13: An administrator needs to develop advanced filters to retrieve information from the QRadar System pertaining to the top abnormal events of the most bandwidth-intensive IP addresses.
How can the administrator do this?

Question14: Which event routing rule is required to add QRadar Data Store (QDS) capability to a deployment?

Question15: An administrator is about to integrate logs from a custom firewall in a QRadar deployment using syslog. The SIEM has two domains, namely Domain A and Domain
B. While reviewing the following sample logs, the administrator notices a "context" keyword:
May 14 11:05:01 192.168.1.23 20190514 11:05:00 context=contextA permit 192.168.1.24 source: 10.10.1.15; source_port: 64094; destination: 10.10.13.34; service: 53; protocol: udp; May 13 12:07:01 192.168.1.23 20190513 11:07:00 context=contextB permit 192.168.1.25 source: 10.10.1.15; source_port: 64094; destination: 10.10.13.34; service: 53; protocol: udp; Which options assign the "contextA" logs to DomainA and the "contextB" logs to domain B? (Choose two.)

Question16: An administrator plans to deploy multiple log sources that share a common configuration.
How many log sources can be added at one time?

Question17: An administrator needs to develop advanced filters to retrieve information from the QRadar System pertaining to the top abnormal events of the most bandwidth-intensive IP addresses.
How can the administrator do this?

Question18: An administrator needs to collect logs from the Command Line Interface (CLI).
Which command should the administrator use?

Question19: An administrator needs to import data into QRadar for a specific use case.
The data that has been provided to the administrator is stored in records that map a key to a value.
Which type of data collection must the administrator create?

Question20: An administrator has been asked to configure a new QRadar console high availability (HA) deployment. Both the primary and secondary consoles have been installed with the QRadar software.
What should the administrator do to complete the HA configuration?

Question21: When troubleshooting issues with QRadar applications, which application Docker container log file can be used to get more information about the apps?

Question22: An administrator needs to save the nightly QRadar backups on a network storage.
The administrator has established the connection to the network storage.
What should the administrator do next?

Question23: Which IBM monitoring application can be used to see detailed health and status information at the application, middleware, and system level?

Question24: An administrator needs to import data into QRadar for a specific use case.
The data that has been provided to the administrator is stored in records that map a key to a value.
Which type of data collection must the administrator create?

Question25: An administrator plans to deploy multiple log sources that share a common configuration.
How many log sources can be added at one time?

Question26: An administrator logs in to the Offenses tab and finds a large number of new Offenses that need action.
What column in the list of Offenses should the administrator use to prioritize them?

Question27: An administrator wants to have all QRadar apps running on a new App Host that was configured to have dedicated CPU, storage and memory resources for the Apps. Several issues were presented during the installation of the App Host.
To troubleshoot, what should the administrator check?

Question28: An administrator has been tasked to create a saved search that shows a list of multiple login failures for a single user by username. The administrator has done the following:
1. Selected Last Hour in the view option.
2. In the Add filter window, selected the search parameter Custom Rule [Indexed].
3. Selected Equals for Operator.
4. Selected Authentication for Rule Group.
What is the next step the administrator needs to perform for the Rule option?

Question29: An administrator has added a new Event Processor to a QRadar deployment.
How many events per second (EPS) are granted from the temporary license and how many days will those EPS last?

Question30: An administrator needs to collect logs from the Command Line Interface (CLI).
Which command should the administrator use?

Question31: An administrator enabled the base license of QRadar Vulnerability Manager.
How many assets can be scanned using this license?

Question32: How many default dashboards does QRadar have?

Question33: A QRadar user reported the following notification:
38750099 - The accumulator was unable to aggregate all events/flows for this interval When does this message appear?

Question34: An administrator needs to import a list of HR staff logins into a reference set.
Which file type can be used with the import function in the reference set editor window?

Question35: An administrator wants to upload a file with information related to network hierarchy instead of using the GUI wizard.
How can the administrator do this?

Question36: A company has several appliances and the administrator needs to copy a file to all appliances to run some tests to verify the integrity of the processes. The /opt/qradar/support/all_servers.sh script can be used to issue commands to all QRadar appliances within the deployment.
What option must be used with the script to copy the file to all appliances in the deployment?

Question37: An administrator needs to combine multiple extraction and calculation-based properties into a single property.
Which Ariel Query Language (AQL) statement can be used?

Question38: What is the minimum memory in gigabyte (GB) required for a QRadar All-in-One Virtual 3199 appliance?

Question39: An administrator enabled the base license of QRadar Vulnerability Manager.
How many assets can be scanned using this license?

Question40: An administrator is tasked to reduce data volumes in the asset database and reduce stale data contributing to asset growth deviation.
How can the administrator tune the configuration of the Asset Profiler?

Question41: An administrator needs to save a search to use it in the dashboards.
To do so, which search feature does the administrator need to select in the "Include in my Dashboard" checkbox?

Question42: An administrator would like to add a new managed host which uses an existing Network Address Translation (NAT).
Which parameters have to be provided if "Host is NATed" is chosen while adding a managed host?

Question43: An administrator may be asked to collect diagnostic information on one of our main services. For example, ecs-ec.
Commands such as:
/opt/qradar/support/thredtop.sh
/opt/qradar/support/jmx.sh
These commands collect thread and statistical information on the Services pipeline, queues and filters.
How would an administrator identify a list of jmx ports for each service?

Question44: Which log should be reviewed to determine the reasons a patch installer did not proceed during a QRadar upgrade?

Question45: Which IBM monitoring application can be used to see detailed health and status information at the application, middleware, and system level?

Question46: An administrator needs to import a list of HR staff logins into a reference set.
Which file type can be used with the import function in the reference set editor window?

Question47: Due to regulatory constraints, an administrator must increase the minimum password length and complexity.
In which QRadar section can the administrator change this setting?

Question48: An administrator needs to add, delete and modify user accounts.
When deleting a user, what dependency checks are carried out?

Question49: An administrator is tasked to reduce data volumes in the asset database and reduce stale data contributing to asset growth deviation.
How can the administrator tune the configuration of the Asset Profiler?

Question50: After fixing the assets that contributed to the asset growth deviation, an administrator needs to find the asset artifacts that have to be cleaned up.
What action should the administrator take to find the artifacts?

Question51: An administrator has been tasked to run all health checks at once using the DrQ command before a major event happens, such as an upgrade.
What does the DrQ command do?

Question52: An administrator enters the QRadar web console into a web browser but does not get a response.
Which process is responsible for the QRadar GUI?

Question53: An administrator needs to develop advanced filters to retrieve information from the QRadar System pertaining to the top abnormal events of the most bandwidth-intensive IP addresses.
How can the administrator do this?

Question54: Which IBM monitoring application can be used to see detailed health and status information at the application, middleware, and system level?

Question55: An administrator plans to deploy multiple log sources that share a common configuration.
How many log sources can be added at one time?