EMT Practice Test

1. Question Content...

---

Question1: A company has recently acquired Guardium software entitlement to help meet their upcoming PCI-DSS audit requirements. The company is entitled to Standard Guardium DAM offering.
Which of the following features can the Guardium administrator use with the current entitlement? (Select two.)

Question2: After a successful purge, a Guardium administrator observes that the full percentage of the Guardium internal database is not decreasing. The administrator uses support show db-top-tables alland finds the size of the largest tables has decreased significantly.
What should the administrator do?

Question3: A Guardium administrator is registering a new Collector to a Central Manager (CM). The registration failed.
As part of the investigation, the administrator wants to identify if the firewall ports are open.
How can the administrator do this?

Question4: Which use cases are covered with the File Activity Monitoring feature? (Select two.)

Question5: A company is installing S-TAPS on new Database Clusters. The Guardium administrator was provided with the PVU load of each node. The clusters are in active/passive mode. The administrator is associating S- TAPs to Collectors using the PVU count.
How should the administrator treat the PVUs of passive nodes?

Question6: A Guardium administrator is preparing a command to install Configuration Auditing System (CAS) on a Linux server using the command line method.
Which parameter is required?

Question7: Auditors request a report of all unsuccessful login attempts to a database monitored by Guardium.
How should a Guardium administrator create such a report?

Question8: A Guardium administrator has an issue with Guardium. The administrator has not seen this particular issue before and needs to get it fixed.
To get this resolved, what should the administrator do?

Question9: A Guardium administrator needs to install and configure a physical appliance to ensure network redundancy.
Which port should the administrator use to configure IP teaming (bonding)?

Question10: Guardium reports are showing multiple records with client ip as 0.0.0.0. Users are unable to identify which client the connections came from. The Guardium administrator has identified that the databases are using encryption.
Which column can the administrator add that would help users to better identify the client?

Question11: A Guardium administrator needs to upgrade BUNDLE-STAP on a Linux server to the latest version using GIM.
What parameter should the administrator set to ensure the upgrade will not require a reboot of the server?

Question12: An administrator has a new standalone Guardium appliance that will be placed into production next week.
The appliance will monitor traffic from a number of databases with a high volume of traffic. The administrator needs to configure the schedule to ensure the appliance internal database does not get full with incoming data.
Which data management function does the administrator need to configure?

Question13: A Guardium administrator handles a large environment and has been asked to restore old data for auditors to review. This old data needs to be restored so that it does not impact the current data being collected or any merge settings. In order to keep the reports separate (old data vs current data), the administrator sets up an Investigation Center.
Which is a key requirement for users of the Investigation Center?

Question14: A company wants to deploy S-TAPs for 2 groups of database servers located in 2 different data centers.
The current set of Collectors are fully utilized. The Aggregators and Central Manager can handle more load.
What should a Guardium administrator recommend?

Question15: A Guardium administrator needs to build new appliances with the latest version of Guardium.
How should the administrator obtain the ISO image?

Question16: A Guardium administrator installed an S-TAP but is not seeing any data in reports on the collector. The administrator discovered that an Inspection Engine is not configured for that S-TAP.
What is an Inspection Engine?

Question17: Simple Mail Transfer Protocol (SMTP) has recently been configured on a Guardium appliance. How can the administrator confirm the configuration is correct? (Select 2)

Question18: A Guardium policy has been configured with the following two rules:


A Guardium administrator is required to check for SQL statements from client IP 9.4.5.6 executed on object "TABLE1".
What domain(s) can the administrator create a report in to see the SQL?

Question19: A Guardium administrator is preparing commands to install or upgrade an S-TAP using the command line method.
Which operating system can use the ktap_allow_module_combosparameter for the installation and upgrade?

Question20: During the initial phase of the Guardium deployment, the Guardium administrator wants to figure out an ideal time period to purge data from the appliance based on the data load.
Which predefined Guardium report(s) allows the administrator to determine the current database disk usage of the Guardium Appliance?

Question21: A Guardium administrator noticed that while the data activity monitoring is working fine, the Guardium appliance is slower than usual. The administrator wants to check the current CPU load of the Guardium appliance.
Which predefined Guardium report(s) allows the administrator to determine the current system CPU load of the Guardium Appliance?

Question22: While looking at the S-TAP Status report on a Collector, a Guardium administrator notices that the status of the S-TAPs is changing every few minutes. The administrator suspects that the sniffer is restarting every few minutes and that is why the status change is happening.
How can the Guardium administrator confirm if the sniffer is restarting every few minutes?

Question23: A Guardium administrator manages portal user synchronization by using a Central Manager.
When a change is made on the Central Manager such as, for example, adding a Guardium user to a Guardium group, how long should be allowed for the update to be synced with the managed units in a fully working environment?

Question24: Which port must be open for encrypted communication between UNIX S-TAP and Collector?

Question25: An administrator manages a Guardium environment including 4 Collectors exporting data to an Aggregator. The Collectors export their data daily at 2, 3, 4 and 5 am Eastern Standard Time (EST) respectively. The Collectors receive traffic every day. The logs on all the Collectors confirm data is exported daily without errors, and all the exported files always have data. A Session report is run on the Aggregator at noon EST for data from the last day.
Which of the following will ensure there is data in the report?

Question26: An administrator just installed the Guardium product using the Guardium ISO image.
Which step must the administrator perform as part of the initial set-up of the new appliance?

Question27: The last Vulnerability Assessment tests performed in a company were run one year ago. The company wants to ensure the Vulnerability Assessment tests keep up with the latest database common vulnerabilities. The company wants to use the Guardium default tests instead of customer designed tests.
What should the Guardium administrator do to update the tests that will be run?

Question28: An infrastructure manager is presented with a few new servers that are available to deploy as a Guardium Collector appliance as part of Guardium project expansion. The Guardium administrator is asked which server option is best for a Guardium Collector.
Which server option can the Guardium administrator use for the new Collector?

Question29: A Guardium administrator is using the Classification, Entitlement and Vulnerability assessment features of the product.
Which of the following are correct with regards to these features? (Select two.)

Question30: A Guardium administrator is creating a policy to alert on actions by users that are stored on an LDAP server.
How can the administrator populate a group to use in the policy?

Question31: A Guardium administrator has rebuilt an appliance, and wants now to restore a backup image of the entire database, audit data, and all definitions from Data Backup.
Which CLI command should the administrator use to accomplish this?

Question32: A Guardium environment is set up to send daily reports to users. The users are complaining that their report has not been delivered to their inbox for the past week.
What is the first action the Guardium administrator should take in order to diagnose the problem?

Question33: A Guardium administrator is setting up a Collector schedule to export data to an Aggregator and Archive its data to an Archive storage unit for additional data safety.
Given this scenario, which is true regarding the purge schedule?

Question34: A Guardium administrator needs to check the traceroute information between one appliance and its Central Manager.
Which CLI command should the administrator run?

Question35: A Guardium administrator installed the BUNDLE-STAP module and is monitoring the state of the install.
Which state requires a database server reboot to complete the installation process?

Question36: The guard_tap.ini of a UNIX S-TAP is configured with the following parameters:
firewall_installed=1
firewall_fail_close=1
firewall_default_state=1
firewall_timeout=10
The collector that this S-TAP is sending data to has become unavailable and there is no failover option configured. A Guardium administrator must communicate the impact of this outage to users of the monitored database.
What should the administrator advise is the expected behavior for a database session?

Question37: A Guardium administrator just finished installing the Guardium product to build a Collector. The administrator wants to make sure the Collector has the licenses needed to provide functionality for data activity monitoring, masking and blocking (terminate).
Which of the following lists the minimum licenses the administrator needs to install?

Question38: During a Guardium deployment planning meeting, the team decides to deploy all S-TAP agents on all Unix/ Linux database systems. A Unix/Linux system administrator team manager asks a Guardium administrator if there are any differences between Guardium S-TAPs for AIX and Linux systems that the team should be aware of.
What should be the Guardium administrator's response?

Question39: The Quick Search window does not show up on the GUI of a standalone Collector.
What technical feature should the Guardium administrator check first?

Question40: A Guardium administrator must configure a policy to ignore all traffic from an application with a known client IP. Due to the high amount of traffic from this application, performance of the S-TAP and sniffer is a concern.
What action should the administrator use in the rule?

Question41: A Guardium administrator needs to monitor changes to the Oracle configuration file on a production Oracle database server.
Assuming all valid licenses are applied, which Guardium component does the administrator need to install and where?

Question42: A Guardium administrator needs to monitor an Oracle database on a production database server.
Which component does the administrator need to install on this database server that will monitor the traffic?

Question43: A Guardium administrator is checking the scheduled jobs exceptions report on a standalone Collector. The following error is repeating every 15 minutes.
java.lang.NumberFormatException: empty String
The administrator also notices that the anomaly detection polling interval is 15 minutes.
What should the administrator do next to contribute troubleshooting the problem?

Question44: The quard_tap.ini of a UNIX S-TAP is configured with the following parameters:
firewall_installed=1
firewall_fail_close=0
firewall_default_state=0
firewall_timeout=10
A Guardium administrator applies a policy to the Collector with two rules as below. The actions of the rules have been hidden.


The administrator must create a policy that will terminate the session on the delete statement in the below scenario:
A session is started to the monitored database from client IP 9.9.8.7. In the session the user plans to perform a select statement and then a delete statement.
What actions should the administrator configure?

Question45: A Guardium administrator observes certain changes to the configuration and policies.
How would the administrator identify the changes that were made and who made them?

Question46: A Guardium administrator plans to use the Guardium Installation Manager (GIM) to install and upgrade agents.
Where should the administrator manually install the GIM client for the first time?

Question47: A Guardium administrator needs to configure EMC Centera for Archive and/or Backup.
In addition to the server IP address, what else is required to establish connection with an EMC Centera on the network?

Question48: A Guardium administrator is planning to build an environment that contains an S-TAP with one primary Collector and one failover Collector.
What must the administrator ensure when setting up this environment?

Question49: A Guardium administrator manages an environment containing four standalone Collectors. The administrator has been asked to provide a weekly report showing all Data Manipulation Language (DML) SQL statements performed by all database administrators on all databases. The administrator does not want to run the report on each Collector.
What should the administrator do to simplify this task and run the report in only one place every week?

Question50: A Guardium administrator needs to use CLI commands to maintain the internal database, clean static orphans, produce static system reports and to monitor live network traffic filtered by IP addresses and port numbers.
Which combination of commands should the administrator use for these tasks?

Question51: In a centrally managed environment, while executing the report 'Enterprise Buffer Usage Monitor', a Guardium administrator gets an empty report.
Why is the report empty?