EMT Practice Test

1. Question Content...

---

Question1: What is Log Insert Lag Time on FortiAnalyzer?

Question2: A rogue administrator was accessing FortiAnalyzer without permission, and you are tasked to see what activity was performed by that rogue administrator on FortiAnalyzer.
What can you do on FortiAnalyzer to accomplish this?

Question3: What two things should an administrator do to view Compromised Hosts on FortiAnalyzer? (Choose two.)

Question4: How can you attach a report to an incident?

Question5: Which two statements are true regarding fabric connectors? (Choose two.)

Question6: Which two external servers can you configure to validate administrator logins? (Choose two.)

Question7: What is the purpose of a predefined template on the FortiAnalyzer?

Question8: What is the purpose of trigger variables?

Question9: Refer to the exhibit.

What does the data point at 14:55 tell you?

Question10: Which statement describes online logs on FortiAnalyzer?

Question11: When working with FortiAnalyzer reports, what is the purpose of a dataset?

Question12: Which statement about the FortiSOAR management extension is correct?

Question13: In order for FortiAnalyzer to collect logs from a FortiGate device, what configuration is required?
(Choose two.)

Question14: What is the purpose of using prefilters when configuring event handlers?

Question15: An administrator has configured the following settings:
config system global
set log-checksum md5-auth
end
What is the significance of executing this command?

Question16: What must be configured to be able to send notifications about incident updates?

Question17: What statements are true regarding FortiAnalyzer's treatment of high availability (HA) dusters?
(Choose two)

Question18: What are two effects of enabling auto-cache in a FortiAnalyzer report? (Choose two.)

Question19: What FortiView tool can you use to automatically build a dataset and chart based on a filtered search result?

Question20: Which two settings must you configure on FortiAnalyzer to allow non-local administrators to authenticate to FortiAnalyzer with any user account in a single LDAP group? (Choose two.)

Question21: Which two statement are true regardless initial Logs sync and Log Data Sync for HA on FortiAnalyzer?

Question22: Which log type does the FortiAnalyzer indicators of compromise feature use to identify infected hosts?

Question23: You created a playbook on FortiAnalyzer that uses a FortiOS connector. When configuring the FortiGate side, which type of trigger must be used so that the actions in an automation stitch are available in the FortiOS connector?

Question24: What is the main purpose of deploying RAID with FortiAnalyzer?

Question25: What are two advantages of setting up fabric ADOM? (Choose two.)

Question26: In the FortiAnalyzer FortiView, source and destination IP addresses from FortiGate devices are not resolving to a hostname.
How can you resolve the source and destination IP addresses, without introducing any additional performance impact to FortiAnalyzer?

Question27: What are analytics logs on FortiAnalyzer?

Question28: Why run the command diagnose sql status sqlplugind?

Question29: Logs are being deleted from one of your ADOMs earlier that the configured setting for archiving in your data policy.
What is the most likely problem?

Question30: What does the disk status Degraded mean for RAID management?

Question31: After generating a report, you notice the information you were expecting to see is not included in it.
What are two possible reasons for this scenario? (Choose two.)

Question32: In the FortiAnalyzer FortiView, source and destination IP addresses from FortiGate devices are not resolving to a hostname.
How can you resolve the source and destination IP addresses, without introducing any additional performance impact to FortiAnalyzer?

Question33: Which statements are correct regarding FortiAnalyzer reports? (Choose two)

Question34: Which two statements about log forwarding are true? (Choose two.)

Question35: If a hard disk fails on a FortiAnalyzer that supports software RAID, what should you do to bring the FortiAnalyzer back to functioning normally, without losing data?

Question36: By default, what happens when a log file reaches its maximum file size?

Question37: Consider the CLI command:

What is the purpose of the command?

Question38: Why must you wait for several minutes before you run a playbook that you just created?

Question39: Which two remote servers are supported for the upload of FortiAnalyzer local logs? (Choose two.)

Question40: Which two actions should an administrator take to view Compromised Hosts on FortiAnalyzer?
(Choose two.)

Question41: Refer to the exhibit.

What is the purpose of using the Chart Builder feature on FortiAnalyzer?

Question42: Which statement is true when you are upgrading the firmware on an HA cluster made up of two FortiAnalyzer devices?

Question43: Which log will generate an event with the status Contained?

Question44: An administrator wants to configure timeouts for users. Regardless of the user's behavior, the timer should start as soon as the user authenticates and expire after the configured value.
Which timeout option should be configured on FortiGate?

Question45: Which FortiAnalyzer feature allows you to retrieve the archived logs matching a specific timeframe from another FortiAnalyzer device?

Question46: What are the operating modes of FortiAnalyzer? (Choose two.)

Question47: Refer to the exhibit.

Why is the total quota less than the total system storage?

Question48: In Log View, you can use the Chart Builder feature to build a dataset and chart based on the filtered search results. Similarly, which feature you can use for FortiView?

Question49: Refer to the exhibits.

How many events will be added to the incident created after running this playbook?

Question50: Which clause is considered mandatory in SELECT statements used by the FortiAnalyzer to generate reports?

Question51: Which two statements are true regarding log fetching on FortiAnalyzer? (Choose two.)

Question52: Which item must you configure on FortiAnalyzer to email generated reports automatically?

Question53: What is the main purpose of using an NTP server on FortiAnalyzer and all of its registered devices?

Question54: Which database language does FortiAnalyzer support for the purposes of logging and reporting?

Question55: If a hard disk on FortiAnalyzer that supports hardware RAID fails, what can be done on FortiAnalyzer?

Question56: Which statements are true regarding securing communications between FortiAnalyzer and FortiGate with IPsec? (Choose two.)

Question57: If the primary FortiAnalyzer in an HA cluster fails, how is the new primary elected?

Question58: How can you configure FortiAnalyzer to permit administrator logins from only specific locations?

Question59: What is the recommended method of expanding disk space on a FortiAnalyzer VM?

Question60: When generating reports on FortiAnalyzer, macros can be used to include additional data.
Which two statements about macros are true? (Choose two.)

Question61: For which two purposes would you use the command set log checksum? (Choose two.)

Question62: What statements are true regarding disk log quota? (Choose two)

Question63: Which SQL query is in the correct order to query the database in the FortiAnalyzer?

Question64: Which statement is true about sending notifications with incident updates?

Question65: When performing a log search on a FortiAnalyzer, it is generally recommended to use the Quick Search option.
What is a valid reason for using the Full Search option, instead?

Question66: When you move a FortiGate device from one ADOM to a new ADOM, what is the purpose of rebuilding the new ADOM database?

Question67: What is the best approach to handle a hard disk failure on a FortiAnalyzer that supports hardware RAID?

Question68: A play book contains five tasks in total. An administrator executed the playbook and four out of five tasks finished successfully, but one task failed.
What will be the status of the playbook after its execution?

Question69: What statements are true regarding the "store and upload" log transfer option between FortiAnalyzer and FortiGate? (Choose three.)

Question70: It is a best practice to upload FortiAnalyzer local logs to a remote server.
Which three remote servers are supported for the upload? (Choose three.)

Question71: An administrator has moved FortiGate A from the root ADOM to ADOM1. However, the administrator is not able to generate reports for FortiGate A in ADOM1.
What should the administrator do to solve this issue?

Question72: What is included in the disk quota for each ADOM on the FortiAnalyzer?

Question73: Which statement about the FortiSIEM management extension is correct?

Question74: Which two statements are correct regarding the export and import of playbooks? (Choose two.)

Question75: A playbook contains five tasks in total. An administrator runs the playbook and four out of five tasks finish successfully, but one task fails.
What will be the status of the playbook after it is run?