EMT Practice Test

1. Question Content...

---

Question1: Refer to the exhibit.

An administrator is investigating a FortiSIEM license issue.
The procedure is for which offline licensing condition?

Question2: Refer to the exhibit.

A FortiSIEM administrator wants to collect both SIEM event logs and performance and availability metrics (PAM) events from a Microsoft Windows server Which protocol should the administrator select in the Access Protocol drop-down list so that FortiSIEM will collect both SIEM and PAM events?

Question3: Where do you configure rule notifications and automated remediation on FortiSIEM?

Question4: An administrator is using SNMP and WMI credentials to discover a Windows device. How will the WMI method handle this?

Question5: Refer to the exhibit.

Which section contains the sortings that determine how many incidents are created?

Question6: Which process converts raw log data to structured data?

Question7: An administrator defines SMTP as a critical process on a Linux server.
It the SMTP process is stopped. FortiSIEM will generate a critical event with which event type?

Question8: What does the Frequency field determine on a rule?

Question9: In the advanced analytical rules engine in FortiSIEM, multiple subpatterms can be referenced using which three operation?(Choose three.)

Question10: FortiSIEM is deployed in disaster recovery mode.
When disaster strikes, which two tasks must you perform manually to achieve a successful disaster recovery operation? (Choose two.)

Question11: Refer to the exhibit.

The FortiSIEM administrator is examining events for two devices to investigate an issue. However, the administrator is not getting any results from their search.
Based on the selected filters shown in the exhibit, why is the search returning no results?

Question12: Device discovery information is stored in which database?

Question13: An administrator is in the process ofrenewing a FortiSIEM license. Which two commands will provide thesystem ID? (Choose two.)

Question14: In me FortiSIEM CLI. which command must you use to determine whether or not syslog is being received from a network device?

Question15: Which discovery scan type is prone to miss a device, if the device is quiet and the entry foe that device is not present in the ARP table of adjacent devices?

Question16: Refer to the exhibit.

A FortiSIEM administrator wants to group some attributes for a report, but is not able to do so successfully.
As shown in the exhibit, why are some of the fields highlighted in red?

Question17: Refer to the exhibit.

How was the FortiGate device discovered by FortiSIEM?

Question18: Which two FortiSIEM components work together to provide real-time event correlation?

Question19: Which command displays the Linux agent status?

Question20: Refer to the exhibits.


Three events are collected over a 10-minute time period from two servers: Server A and Server B.
Based on the settings tor the rule subpattern. how many incidents will the servers generate?

Question21: Which statement about global thresholds and per device thresholds is true?

Question22: Refer to the exhibit.

What does the pauso icon indicate?

Question23: In FortiSIEM enterprise licensing mode, it the link between the collector and data center FortiSlEM cluster is down, what happens?

Question24: Which three ports can be used to send Syslogs to FortiSIEM? (Choose three.)

Question25: A customer is experiencing slow performance while executing long, adhoc analytic searches Which FortiSIEM component can make the searches run faster?