EMT Practice Test

1. Question Content...

---

Question1: Which of the following is crucial when defining and deploying collectors and agents in a SOC environment?

Question2: On which disk are the SQLite databases that are used for the baselining stored?

Question3: What is the estimated time that it would take for the collector to reach the maximum buffer size for a
2000 EPS license?

Question4: Refer to the exhibit.

An administrator deploys a new collector for the first time, and notices that all the processes except the phMonitor are down.
How can the administrator bring the processes up?

Question5: What are the modes of Data Ingestion on FortiSOAR? (Choose three.)

Question6: Refer to the exhibit.

Is the Windows agent delivering event logs correctly?

Question7: Refer to the exhibit.

Which statement about the rule filters events shown in the exhibit is true?

Question8: Which of the following are valid remediation actions in FortiSIEM?

Question9: When constructing FortiSIEM baseline rules, what would be an effective approach?

Question10: How can you invoke an integration policy on FortiSIEM rules?

Question11: In the context of FortiSIEM, why is establishing a proper baseline essential?

Question12: Refer to the exhibit.

Which device would run the processes shown in the exhibit?

Question13: Refer to the exhibit.

An administrator runs an analytic search for all FortiGate SSL VPN logon failures. The results are grouped by source IP, reporting IP, and user. The administrator wants to restrict the results to only those rows where the COUNT >= 3.
Which user would meet that condition?

Question14: When constructing FortiSIEM baseline rules, what is a primary consideration?

Question15: What is recommended method of adding workers to a FortiSIEM cluster?

Question16: Which of the following can be an outcome if a FortiSIEM rule detects a suspicious login attempt?

Question17: FortiSOAR is primarily used for:

Question18: How do customers connect to a shared multi-tenant instance on FortiSOAR?

Question19: What are two ways of search for connectors when adding connectors to a playbook connector step?
(Choose two.)

Question20: FortiSIEM agents are responsible for:

Question21: Multi-tenancy solutions for SOC environments primarily serve to:

Question22: FortiSIEM rules, when triggered, can lead to which of the following actions?

Question23: When integrating FortiSOAR with FortiSIEM for remediation, the primary goal is to:

Question24: The main benefit of a multi-tenancy SOC solution for an MSSP is:

Question25: Which are key considerations when installing FortiSIEM agents on diverse operating systems?

Question26: For an MSSP looking to provide SOC solutions to multiple clients, the most scalable and efficient approach would be to:

Question27: Which statement about EPS bursting is true?

Question28: What task does phRuleWorker perform on the worker?

Question29: Refer to the exhibit.

An administrator wants to remediate the incident from FortiSIEM shown in the exhibit.
What option is available to the administrator?

Question30: FortiSIEM's UEBA capabilities primarily focus on:

Question31: Refer to the exhibit.

The rule evaluates multiple VPN logon failures within a ten-minute window.
Consider the following VPN failure events received within a ten-minute window:

How many incidents are generated?

Question32: Refer to the exhibit.

Why is the windows device still in the CMDB, even though the administrator uninstalled the windows agent?

Question33: What will be the correct data type for inner query?

Question34: Which two statements are true regarding template creation? (Choose two.)

Question35: Why are FortiSIEM baseline and profile reports crucial?

Question36: During which time period is the license enforcement performed on the number of events received?

Question37: What are the benefits of understanding the MITRE ATT&CK® framework in the context of FortiSIEM?

Question38: What is the disadvantage of automatic remediation?

Question39: In the context of a multi-tenancy SOC solution, what role do collectors play?