EMT Practice Test

1. Question Content...

---

Question1: Which statement about the FortiSIEM management extension is correct?

Question2: Which FortiAnalyzer feature allows you to use a proactive approach when managing your network security?

Question3: After generating a report, you notice the information you where expecting to see is not included in it.
However, you confirm that the logs are there.

Question4: Which two statements about local logs on FortiAnalyzer are true? (Choose two.)

Question5: Which log will generate an event with the status Unhandled?

Question6: After a generated a repot, you notice the information you were expecting to see in not included in it. However, you confirm that the logs are there:
Which two actions should you perform? (Choose two.)

Question7: An administrator on your team has configured multiple reports to run periodically. Management has an additional request that all new generated reports be sent to a company email inbox for accessibility. The mail server has already been configured on FortiAnalyzer.
Which item must configureon FortiAnalyzer so that emails are sent when the reports are generated?

Question8: You are trying to configure a task in the playbook editor to run a report.
However, when you try to select the desired playbook, you do to see it listed.
What is the reason?

Question9: Which statement about SQL SELECT queries is true?

Question10: What is the purpose of running the command diagnose sql status sqlreportd?

Question11: Which statement correctly describes one Difference between templates and reports?

Question12: Which statement regarding macros on FortiAnalyzer is true?

Question13: What is the purpose of playbook trigger variables?

Question14: Exhibit.

What is the analyst trying to create?

Question15: What happens when the indicator of compromise (IOC) engine on FortiAnalyzer finds web logs that match blacklisted IP addresses?

Question16: Exhibit.

Laptop1 is used by several administrators to manage FotiAnalyzer. You want to configure a generic text filter that matches all login attempts to the web interface generated by any user other than admin'', and coming from Laptop1.
Which filter will achieve the desired result?

Question17: What are two effects of enabling auto-cache in a FortiAnalyzer report? (Choose two.)

Question18: As part of your analysis, you discover that a Medium severity level incident is fully remediated.
You change the incident status to Closed:Remediated.
Which statement about your update is true?

Question19: When managing incidents on FortiAnlyzer, what must an analyst be aware of?

Question20: Exhibit.

What is the purpose of using the Chart Builder feature On FortiAnalyzer?

Question21: Which SQL query is in the correct order to query to database in the FortiAnalyzer?

Question22: Exhibit.

Which statement about the event displayed is correct?

Question23: Which two methods can you use to send notifications when an event occurs that matches a configured event handler? (Choosetwo.)