EMT Practice Test

1. Question Content...

---

Question1: What must you configure on FortiAnalyzer to upload a FortiAnalyzer report to a supported external server? (Choose two.)

Question2: Which two statements about local logs on FortiAnalyzer are true? (Choose two.)

Question3: Which two FortiAnalyzer features allow you to automatically build a dataset and chart based on a filtered search result? (Choose two.)

Question4: An administrator has configured the following settings:
config system fortiview settings
set resolve-ip enable
end
What is the significance of executing this command?

Question5: Refer to Exhibit:

Client-1 is trying to access the internet for web browsing.
All FortiGate devices in the topology are part of a Security Fabric with logging to FortiAnalyzer configured.
All firewall policies have logging enabled. All web filter profiles are configured to log only violations.
Which statement about the logging behavior for this specific traffic flow is true?

Question6: An administrator on your team has configured multiple reports to run periodically. Management has an additional request that all new generated reports be sent to a company email inbox for accessibility. The mail server has already been configured on FortiAnalyzer.
Which item must configureon FortiAnalyzer so that emails are sent when the reports are generated?

Question7: Which log will generate an event with the status Contained?

Question8: What statements are true regarding FortiAnalyzer's treatment of high availability (HA) dusters?
(Choose two)

Question9: Which two actions should an administrator take to view Compromised Hosts on FortiAnalyzer?
(Choose two.)

Question10: Which daemon is responsible for enforcing raw log file size?

Question11: Which statement about the FortiSOAR management extension is correct?

Question12: What are offline logs on FortiAnalyzer?

Question13: What database language does FortiAnalyzer use for logging and reporting?

Question14: Refer to the exhibit with partial output:

Your colleague exported a playbook and has sent it to you for review. You open the file in a text editor and observer the output as shown in the exhibit.
Which statement about the export is true?

Question15: Which statement about sending notifications with incident update is true?

Question16: A playbook contains five tasks in total. An administrator runs the playbook and four out of five tasks finish successfully, but one task fails.
What will be the status of the playbook after it is run?

Question17: After generating a report, you notice the information you were expecting to see is not included in it.
What are two possible reasons for this scenario? (Choose two.)

Question18: An administrator wants to configure timeouts for users. Regardless of the user's behavior, the timer should start as soon as the user authenticates and expire after the configured value.
Which timeout option should be configured on FortiGate?

Question19: How can you attach a report to an incident?

Question20: Which two statements are true regarding ADOM modes? (Choose two.)

Question21: What is the purpose of trigger variables?

Question22: What are the operating modes of FortiAnalyzer? (Choose two.)

Question23: Consider the CLI command:

What is the purpose of the command?

Question24: What is the purpose of using prefilters when configuring event handlers?

Question25: Which two items are downloaded automatically by the Outbreak Detection Service? (Choose two.)

Question26: What is the main purpose of using an NTP server on FortiAnalyzer and all of its registered devices?

Question27: When managing incidents on FortiAnlyzer, what must an analyst be aware of?

Question28: An administrator has moved FortiGate A from the root ADOM to ADOM1.
Which two statements are true regarding logs? (Choose two.)

Question29: Exhibit.

What can you conclude about the output?

Question30: In the FortiAnalyzer FortiView, source and destination IP addresses from FortiGate devices are not resolving to a hostname.
How can you resolve the source and destination IP addresses, without introducing any additional performance impact to FortiAnalyzer?

Question31: What must be configured to be able to send notifications about incident updates?

Question32: What is the purpose of the following CLI command?

Question33: Which database language does FortiAnalyzer support for the purposes of logging and reporting?

Question34: Which SQL query is in the correct order to query the database in the FortiAnalyzer?

Question35: FortiAnalyzer centralizes which functions? (Choose three)

Question36: What is the purpose of a dataset query in FortiAnalyzer?

Question37: Refer to the exhibit.

The image displays the configuration of a FortiAnalyzer the administrator wants to join to an existing HA cluster.
What can you conclude from the configuration displayed?

Question38: An administrator fortinet, is able to view logs and perform device management tasks, such as adding and removing registered devices. However, administrator fortinet is not able to create a mall server that can be used to send email.
What could be the problem?

Question39: If a hard disk on FortiAnalyzer that supports hardware RAID fails, what can be done on FortiAnalyzer?

Question40: What are two of the key features of FortiAnalyzer? (Choose two.)

Question41: After generating a report, you notice the information you where expecting to see is not included in it.
However, you confirm that the logs are there.

Question42: What types of logs will FortiAnalyzer store?

Question43: What FortiGate process caches logs when FortiAnalyzer is not reachable?

Question44: Which statements are correct regarding FortiAnalyzer reports? (Choose two)

Question45: Which statement about the FortiSIEM management extension is correct?

Question46: In Log View, you can use the Chart Builder feature to build a dataset and chart based on the filtered search results. Similarly, which feature you can use for FortiView?

Question47: The admin administrator is failing to register a FortiClient EMS on the FortiAnalyzer device.
What can be the reason for this failure?

Question48: Which SQL query is in the correct order to query to database in the FortiAnalyzer?

Question49: Why should you use an NTP server on FortiAnalyzer and all registered devices that log into FortiAnalyzer?

Question50: What can the CLI command # diagnose test application oftpd 3 help you to determine?

Question51: When working with FortiAnalyzer reports, what is the purpose of a dataset?

Question52: A play book contains five tasks in total. An administrator executed the playbook and four out of five tasks finished successfully, but one task failed.
What will be the status of the playbook after its execution?

Question53: What is included in the disk quota for each ADOM on the FortiAnalyzer?

Question54: When you move a FortiGate device from one ADOM to a new ADOM, what is the purpose of rebuilding the new ADOM database?

Question55: What is the purpose of a predefined template on the FortiAnalyzer?

Question56: How does FortiAnalyzer retrieve specific log data from the database?

Question57: You've moved a registered logging device out of one ADOM and into a new ADOM.
What happens when you rebuild the new ADOM database?

Question58: Which statement is true regarding Macros on FortiAnalyzer?

Question59: Refer to Exhibit:

What does the data point at 21:20 indicate?

Question60: Which two of the following must you configure on FortiAnalyzer to email a FortiAnalyzer report externally? (Choose two.)

Question61: Why must you wait for several minutes before you run a playbook that you just created?

Question62: Which log type does the FortiAnalyzer indicators of compromise feature use to identify infected hosts?

Question63: What happens when the IOC breach detection engine on FortiAnalyzer finds web logs that match a blocklisted IP address?

Question64: Exhibit.

Laptop1 is used by severaladministratorsto manage FotiAnalyzer. You want to configure a generic text filter that matches all login attempts to the web interface generated by any user other than admin'', and coming from Laptop1.
Which filter will achieve the desired result?

Question65: What are two benefits of using fabric connectors? (Choose two.)

Question66: Exhibit.

A fortiAnalyzer analyst is customizing a SQL query to use in a report.
Which SQL query should the analyst run to get the expected results?

Question67: What happens when a log file saved on FortiAnalyzer disks reaches the size specified in the device log settings?

Question68: Exhibit.

What can you conclude from this output?

Question69: Which two statements are true regarding FortiAnalyzer operating modes? (Choose two.)

Question70: Which statement is true when you are upgrading the firmware on an HA cluster made up of two FortiAnalyzer devices?

Question71: What is the main purpose of deploying RAID with FortiAnalyzer?

Question72: What is the purpose of running the command diagnose sql status sqlreportd?

Question73: On the RAID management page, the disk status is listed as Initializing.
What does the status Initializing indicate about what the FortiAnalyzer is currently doing?

Question74: You have recently grouped multiple FortiGate devices into a single ADOM. System Settings > Storage Info shows the quota used.
What does the disk quota refer to?

Question75: Which tabs do not appear when FortiAnalyzer is operating in Collector mode?

Question76: Which two statements about log forwarding are true? (Choose two.)

Question77: Refer to the exhibit.

What does the data point at 14:55 tell you?

Question78: Which two statements are true regarding FortiAnalyzer log forwarding? (Choose two.)

Question79: What are event handlers?

Question80: For which two SAML roles can the FortiAnalyzer be configured? (Choose two.)

Question81: Which two statement are true regardless initial Logs sync and Log Data Sync for HA on FortiAnalyzer?

Question82: A playbook contains five tasks in total. An administrator runs the playbook and four out of five tasks finish successfully, but one task fails.
What will be the status of the playbook after it is run?

Question83: Why run the command diagnose sql status sqlplugind?

Question84: If the primary FortiAnalyzer in an HA cluster fails, how is the new primary elected?

Question85: A FortiAnalyzer device could use which security method to secure the transfer of log data from FortiGate devices?