EMT Practice Test

1. Question Content...

---

Question1: Identify the processes associated with Machine Learning/Al on FortiSIEM. (Choose two.)

Question2: Refer to the exhibit.

Why is the windows device still in the CMDB, even though the administrator uninstalled the windows agent?

Question3: What is the hourly bucket used in baselining?

Question4: What are two functions of numpoints in a rule and profile database? (Choose two.)

Question5: FortiSIEM provides all rules with the ability to automatically change an active incident status to auto-cleared, based on an extra set of defined criteria.
Why would you configure FortiSIEM to automatically change an active incident status to auto-cleared?

Question6: When constructing FortiSIEM baseline rules, what would be an effective approach?

Question7: Which function of Linux is used by FortiSIEM for collecting logs?

Question8: Which three statements about phRuleMaster are true? (Choose three.)

Question9: Refer to the exhibit.

Is the Windows agent delivering event logs correctly?

Question10: For an MSSP looking to provide SOC solutions to multiple clients, the most scalable and efficient approach would be to:

Question11: Which three statements about collector communication with the FortiSIEM cluster are true? (Choose three.)

Question12: Which of the following is crucial when defining and deploying collectors and agents in a SOC environment?

Question13: What happens to events that the collector receives when there is a WAN link failure between the collector and the supervisor?

Question14: UEBA in the context of FortiSIEM stands for:

Question15: Refer to the exhibit.

Which deployment type is shown in the exhibit?

Question16: What are the benefits of understanding the MITRE ATT&CK® framework in the context of FortiSIEM?

Question17: Which syntax will register a collector to the supervisor?

Question18: Which organization do agents belong to after registration? (Choose two.)

Question19: Which two statements about the maximum device limit on FortiSIEM are true? (Choose two.)

Question20: How often do collectors upload data to the Supervisor? (Choose two.)

Question21: Multi-tenancy solutions for SOC environments primarily serve to:

Question22: Which of the following are valid remediation actions in FortiSIEM?

Question23: In the context of FortiSIEM, why is establishing a proper baseline essential?

Question24: Refer to the exhibit.

Why was this incident auto cleared?

Question25: A service provider purchased a 500-EPS license and configured a new collector with 100 EPS for customer A, and another collector with 200 EPS for customer B.
How much is in the remaining EPS pool for future customers and for MSSP itself?

Question26: Refer to the exhibit.

An administrator wants to remediate the incident from FortiSIEM shown in the exhibit.
What option is available to the administrator?

Question27: Refer to the exhibit.

The window for this rule is 30 minutes.
What is this rule tracking?

Question28: Refer to the exhibit.

A service provider does not have a dedicated worker in the cluster, but still wants to add a collector to an organization.
What option does the administrator have?

Question29: Refer to the exhibit.

Based on the information provided in the exhibit, calculate the unused events for the next three minutes for a 520 EPS license.

Question30: Refer to the exhibit.

The profile database contains CPU utilization values from day one. At midnight on the second day, the CPU utilization values from the daily database will be merged with the profile database.
In the profile database, in theHour of Daycolumn where9is the value, what will be the updated minimum, maximum, and average CPU utilization values?

Question31: When explaining FortiSIEM rule processing, which of the following elements is crucial?

Question32: Refer to the exhibit.

Why is the windows device still in the CMDB, even though the administrator uninstalled the windows agent?

Question33: Refer to the exhibit.

The service provider deployed FortiSIEM without a collector and added three customers on the supervisor.
What mistake did the administrator make?

Question34: What task does phRuleWorker perform on the worker?

Question35: Refer to the exhibit.

An administrator deploys a new collector for the first time, and notices that all the processes expect the phMonitor are down.
How can the administrator bring the processes up?

Question36: What happens to UEBA events when a user is off-net?

Question37: Refer to the exhibit.

An administrator deploys a new collector for the first time, and notices that all the processes except the phMonitor are down.
How can the administrator bring the processes up?

Question38: Refer to the exhibit.

The window for this rule is 30 minutes.
What is this rule tracking?

Question39: Which lookup table function can be either true or false?

Question40: How can you customize the AI model on FortiSIEM?

Question41: What are two reasons that agents maintain communication with the supervisor after registration?
(Choose two.)

Question42: Refer to the exhibit.

The rule evaluates multiple VPN logon failures within a ten-minute window. Consider the following VPN failure events received within a ten-minute window:

How many incidents are generated?

Question43: Which three processes are collector processes? (Choose three.)

Question44: When managing FortiSIEM agents on a Linux server, which task is crucial?

Question45: A service provider purchases a licensed EPS of 520. The guaranteed EPS allocated to three customers is 50,
100, and 150 respectively. At the end of every three-minute interval, incoming EPS is calculated at every collector and the value is sent to the central decision-making engine on the supervisor node.
The incoming EPS for the first collector is 25. the incoming EPS for the second collector is 50, and the incoming EPS for the third collector is 75.
Based on the information provided, what is the unused events total calculated by the supervisor?

Question46: Refer to the exhibit.

The rule evaluates multiple VPN logon failures within a ten-minute window.
Consider the following VPN failure events received within a ten-minute window:

How many incidents are generated?

Question47: If a FortiSIEM rule is constructed to detect a potential data exfiltration attempt, which framework can provide insights on the techniques attackers might use for this purpose?

Question48: For what type of data values does the rule engine query the profile database?

Question49: In the context of a multi-tenancy SOC solution, what role do collectors play?

Question50: During which time period is the license enforcement performed on the number of events received?

Question51: When you perform a Group By on a structured query, which two outcomes occur? (Choose two.)

Question52: How do customers connect to a shared multi-tenant instance on FortiSOAR?

Question53: Refer to the exhibit.

What are three possible reasons why theAgent StatusdisplaysRunning Inactive? (Choose three.)

Question54: What is the primary function of FortiSIEM rule processing?

Question55: Why are FortiSIEM baseline and profile reports crucial?

Question56: What are two ways of search for connectors when adding connectors to a playbook connector step?
(Choose two.)

Question57: Refer to the exhibit.

Consider a nested event query where both inner and outer queries are event queries.
Reporting IPis selected from the CMDB groupNetwork Device, Event Typeis selected from the CMDB groupLogon Success,andSource IPis selected from the reportFailed Logons to Network Devices.
An administrator is about to execute the nested query. The report time ranges must be set before execution.
TheNested Time Rangewill be applied to which attributes?

Question58: Refer to the exhibit.

The collector is registered and has pulled the license file from the supervisor.
What are the consequences of removing the license file?

Question59: The MITRE ATT&CK® framework is primarily designed to: