EMT Practice Test

1. Question Content...

---

Question1: You must find a specific security event log in the FortiAnalyzer logs displayed in FortiView, but, so far, you have been uncuccessful.
Which two tasks should you perform to investigate why you are having this issue? (Choose two.)

Question2: Which statement about sending notifications with incident update is true?

Question3: What is the purpose of using data selectors when configuring event handlers?

Question4: Refer to Exhibit:

Client-1 is trying to access the internet for web browsing.
All FortiGate devices in the topology are part of a Security Fabric with logging to FortiAnalyzer configured. All firewall policies have logging enabled. All web filter profiles are configured to log only violations.
Which statement about the logging behavior for this specific traffic flow is true?

Question5: Which statement describes archive logs on FortiAnalyzer?

Question6: Which log will generate an event with the status Contained?

Question7: You find that as part of your role as an analyst, you frequently search log View using the same parameters.
Instead of defining your search filters repeatedly, what can you do to save time?

Question8: Which two methods can you use to send notifications when an event occurs that matches a configured event handler? (Choose two.)

Question9: Exhibit.


Assume these are all the events that exist on the FortiAnalyzer device.
How many events will be added to the incident created after running this playbook?

Question10: What happens when the indicator of compromise (IOC) engine on FortiAnalyzer finds web logs that match blacklisted IP addresses?

Question11: Exhibit.

Laptop1 is used by several administrators to manage FotiAnalyzer. You want to configure a generic text filter that matches all login attempts to the web interface generated by any user other than admin'', and coming from Laptop1.
Which filter will achieve the desired result?

Question12: Refer to the exhibit.

What can you conclude about the output?

Question13: Exhibit.

A fortiAnalyzer analyst is customizing a SQL query to use in a report.
Which SQL query should the analyst run to get the expected results?

Question14: You are tasked with finding logs corresponding to a suspected attack on your network.
You need to use an interface where all identified threats within timeframe are listed and organized. You also need to be able to quickly export the information to a PDF file.
Where can you go to accomplish this task?

Question15: Which two statements about playbook execution are true? (Choose two)

Question16: Which statement regarding macros on FortiAnalyzer is true?

Question17: Exhibit.

Based on the partial outputs displayed, which devices can be members of a FotiAnalyzer Fabric?

Question18: Which log will generate an event with the status Unhandled?

Question19: Exhibit.

What is the purpose of using the Chart Builder feature On FortiAnalyzer?

Question20: When managing incidents on FortiAnlyzer, what must an analyst be aware of?

Question21: Refer to Exhibit:

What does the data point at 21:20 indicate?

Question22: Which two statements about exporting and importing playbacks are true? (Choose two.)

Question23: Which two statement regarding the outbreak detection service are true? (Choose two.)

Question24: After generating a report, you notice the information you where expecting to see is not included in it. However, you confirm that the logs are there.

Question25: You need to move reports between two ADOMs.
Which two statements are true? (Choose two.)

Question26: You are trying to configure a task in the playbook editor to run a report.
However, when you try to select the desired playbook, you do to see it listed.
What is the reason?

Question27: Refer to the exhibit with partial output:

Your colleague exported a playbook and has sent it to you for review. You open the file in a text editor and observer the output as shown in the exhibit.
Which statement about the export is true?

Question28: Exhibit.

What can you conclude from this output?