EMT Practice Test

1. Question Content...

---

Question1: In FortiAnalyzer's FormView, source and destination IP addresses from FortiGate devices are not resolving to a hostname. How can you resolve the source and destination IPs, without introducing any additional performance impact to FortiAnalyzer?

Question2: Which statement about the FortiSIEM management extension is correct?

Question3: Refer to the exhibit.

Laptopt is used by several administrators to manage FortiAnalyzer. You want to configure a generic text filter that matches all login attempts to the web interface generated by any user other than "admin" and coming from Laptop1:
Which filter will achieve the desired result?

Question4: What is the recommended method of expanding disk space on a FortiAnalyzer VM?

Question5: What FortiGate process caches logs when FortiAnalyzer is not reachable?

Question6: Which statement about the FortiSOAR management extension is correct?

Question7: A playbook contains five tasks in total. An administrator runs the playbook and four out of five tasks finish successfully, but one task fails. What will be the status of the playbook after it is run?

Question8: When you perform a system backup, what does the backup configuration contain? (Choose two.)

Question9: Which two statement are true regardless initial Logs sync and Log Data Sync for Ha on FortiAnalyzer?

Question10: Which two statements are true regarding ADOM modes? (Choose two.)

Question11: If the primary FortiAnalyzer in an HA cluster fails, how is the new primary elected?

Question12: Refer to the exhibit.

Which statement is correct regarding the event displayed?

Question13: What is the best approach to handle a hard disk failure on a FortiAnalyzer that supports hardware RAID?

Question14: If you upgrade the FortiAnalyzer firmware, which report element can be affected?

Question15: Logs are being deleted from one of your ADOMs earlier that the configured setting for archiving in your data policy. What is the most likely problem?

Question16: On the RAID management page, the disk status is listed asInitializing.
What does the statusInitializingindicate about what the FortiAnalyzer is currently doing?

Question17: After generating a report, you notice the information you were expecting to see is not included in it. What are two possible reasons for this scenario? (Choose two.)

Question18: If you upgrade your FortiAnalyzer firmware, what report elements can be affected?

Question19: Refer to the exhibit.

What does the data point at 14:55 tell you?

Question20: Which clause is considered mandatory in SELECT statements used by the FortiAnalyzer to generate reports?

Question21: Which statements are true regarding securing communications between FortiAnalyzer and FortiGate with IPsec? (Choose two.)

Question22: Which FortiAnalyzer feature allows you to use a proactive approach when managing your network security?

Question23: Which two statements are true regarding FortiAnalyzer log forwarding? (Choose two.)

Question24: Which two methods can you use to send event notifications when an event occurs that matches a configured event handler? (Choose two.)

Question25: A play book contains five tasks in total. An administrator executed the playbook and four out of five tasks finished successfully, but one task failed. What will be the status of the playbook after its execution?

Question26: Which statement about sending notifications with incident updates is true?

Question27: What must you configure on FortiAnalyzer to upload a FortiAnalyzer report to a supported external server?
(Choose two.)

Question28: Which statements are correct regarding FortiAnalyzer reports? (Choose two)

Question29: What is the purpose of employing RAID with FortiAnalyzer?

Question30: Consider the CLI command:

What is the purpose of the command?

Question31: Refer to the exhibit.

What is the purpose of using the Chart Builder feature on FortiAnalyzer?

Question32: Refer to the exhibit.

What is the purpose of using the Chart Builder feature on FortiAnalyzer?

Question33: View the exhibit.

Why is the total quota less than the total system storage?

Question34: Which statement about the FortiSOAR management extension is correct?

Question35: You've moved a registered logging device out of one ADOM and into a new ADOM. What happens when you rebuild the new ADOM database?

Question36: What is the purpose of the following CLI command?

Question37: Which statement is true when you are upgrading the firmware on an HA cluster made up of two FortiAnalyzer devices?

Question38: An administrator has moved FortiGate A from the root ADOM to ADOM1.
Which two statements are true regarding logs? (Choose two.)

Question39: How can you configure FortiAnalyzer to permit administrator logins from only specific locations?

Question40: What are two effects of enabling auto-cache in a FortiAnalyzer report? (Choose two.)

Question41: You are using RAID with a FortiAnalyzer that supports software RAID, and one of the hard disks on FortiAnalyzer has failed.
What is the recommended method to replace the disk?

Question42: Why should you use an NTP server on FortiAnalyzer and all registered devices that log into FortiAnalyzer?

Question43: What statements are true regarding disk log quota? (Choose two)

Question44: When working with FortiAnalyzer reports, what is the purpose of a dataset?

Question45: What can you do on FortiAnalyzer to restrict administrative access from specific locations?

Question46: How do you restrict an administrator's access to a subset of your organization's ADOMs?

Question47: Which FortiAnalyzer feature allows you to retrieve the archived logs matching a specific timeframe from another FortiAnalyzer device?

Question48: An administrator has configured the following settings:
config system fortiview settings
set resolve-ip enable
end
What is the significance of executing this command?

Question49: Which two actions should an administrator take to view Compromised Hosts on FortiAnalyzer? (Choose two.)

Question50: What can the CLI command # diagnose test application oftpd 3 help you to determine?

Question51: For which two SAML roles can the FortiAnalyzer be configured? (Choose two.)

Question52: Which two statements about log forwarding are true? (Choose two.)

Question53: View the exhibit.

What does the data point at 14:35 tell you?

Question54: What is the purpose of output variables?

Question55: What is the purpose of a predefined template on the FortiAnalyzer?

Question56: View the exhibit:

What does the 1000MB maximum for disk utilization refer to?

Question57: Which two settings must you configure on FortiAnalyzer to allow non-local administrators to authenticate to FortiAnalyzer with any user account in a single LDAP group? (Choose two.)

Question58: You have recently grouped multiple FortiGate devices into a single ADOM. System Settings > Storage Info shows the quota used.
What does the disk quota refer to?

Question59: After you have moved a registered logging device out of one ADOM and into a new ADOM, what is the purpose of running the following CLI command?
execute sql-local rebuild-adom <new-ADOM-name>

Question60: Which two statements are true regarding high availability (HA) on FortiAnalyzer? (Choose two.)

Question61: What statements are true regarding the "store and upload" log transfer option between FortiAnalyzer and FortiGate? (Choose three.)

Question62: Why run the command diagnose sql status sqlplugind?

Question63: You need to upgrade your FortiAnalyzer firmware.
What happens to the logs being sent to FortiAnalyzer from FortiGate during the time FortiAnalyzer is temporarily unavailable?

Question64: Which two constraints can impact the amount of reserved disk space required by FortiAnalyzer? (Choose two.)

Question65: Refer to the exhibit.

Based on the partial outputs displayed, which devices can be members of a FortiAnalyzer Fabric?

Question66: Which two of the following must you configure on FortiAnalyzer to email a FortiAnalyzer report externally?
(Choose two.)