EMT Practice Test

1. Question Content...

---

Question1: Which command in QRadar allows you to run a specific command inside of a specific container, when given an app ID. or a combination of workload, service, and container?

Question2: On which managed hosts is QRadar event data stored in the Ariel database?

Question3: A QRadar administrator creates a new saved search in QRadar.
Which option does the administrator enable to allow this search to be opened as the Log Activity tab is opened?

Question4: Which two (2) data sources can be assigned to a domain in the Domain Management function?

Question5: Which command does an administrator run in QRadar to get a list of installed applications and their App-ID values output to the screen?

Question6: Before configuring a WinCollect log source, which two ports does a QRadar administrator ensure are open?

Question7: When will events or flows stop contributing to an offense?

Question8: To detect outliers, which Anomaly Detection Engine rule tests events or flows for volume changes that occur in regular patterns?

Question9: From which two (2) resources can an administrator download QRadar security content?

Question10: A QRadar administrator needs to quickly check the disk space for all managed hosts. Which command does the administrator use?

Question11: What occurs when QRadar reaches the events per second (EPS) or flows per minute (FPM) shared license pool limits?

Question12: How can an administrator configure a rule response to add event data to a reference set?

Question13: What parameter contributes to the magnitude score of an offense?

Question14: Which command can a QRadar administrator use to connect to the QRadar app container?

Question15: When restoring backups of your apps in a QRadar environment, what information is restored?

Question16: Which is a benefit of a lazy search?

Question17: In the QRadar GUI. you notice that no new offenses were generated today. A review of the notifications shows:
MPC: Unable to create new offense. The maximum number of active offenses has been reached.
What is the default value of the maximum number?

Question18: An administrator would like to optimize event and flow payload searches for log data that is stored for up to a month. What does an administrator need to do to achieve that requirement?

Question19: When configuring a log source, which protocols are used when receiving data into the event ingress component?

Question20: Which user role is defined by default in QRadar?

Question21: A ORadar administrator creates a new saved search in QRadar and wants to add the search to a dashboard, but the option "Include in my Dashboard" cannot be selected.
What is a possible reason it is unavailable?

Question22: What is the main reason for tuning a building block?

Question23: An administrator is evaluating domain criteria based on an event. The result of a regular expression that was defined in a custom property does not match a domain mapping, and the event was automatically assigned to the default domain.
What is the order of precedence if the event does not match the domain definition for custom properties?

Question24: Which field is mandatory when you use the DSM Editor to map an event to a OID?