EMT Practice Test

1. Question Content...

---

Question1: Which statement about global thresholds and per device thresholds is true?

Question2: Refer to the exhibit.

The FortiSIEM administrator is examining events for two devices to investigate an issue. However, the administrator is not getting any results from their search.
Based on the selected filters shown in the exhibit, why is the search returning no results?

Question3: Refer to the exhibit.

A FortiSIEM is continuously receiving syslog events from a FortiGate firewall The FortiSlfcM administrator is trying to search the raw event logs for the last two hours that contain the keyword tcp . However, the administrator is getting no results from the search.
Based on the selected filters shown in the exhibit, why are there no search results?

Question4: Refer to the exhibit.

What does the pauso icon indicate?

Question5: An administrator is using SNMP and WMI credentials to discover a Windows device. How will the WMI method handle this?

Question6: What does the Frequency field determine on a rule?

Question7: Refer to the exhibit.

If events are grouped by User. Source IP. and Application Category attributes in FortiSiEM. how many results will be displayed?

Question8: Refer to the exhibit.

It events are grouped by Event Type and User attributes in FortiSIEM. how many results will be displayed?

Question9: Which discovery scan type is prone to miss a device, if the device is quiet and the entry foe that device is not present in the ARP table of adjacent devices?

Question10: Refer to the exhibit.

Which value will FortiSIEM use to populate the Connection Id field?

Question11: An administrator is in the process of renewing a FortiSIEM license. Which two commands will provide the system ID? (Choose two.)

Question12: Where must you configure rule notifications and automated remediation on FortiSIEM?

Question13: Which process converts raw log data to structured data?

Question14: Which FortiSIEM components can do performance availability and performance monitoring?

Question15: In FortiSIEM enterprise licensing mode, it the link between the collector and data center FortiSlEM cluster is down, what happens?

Question16: An administrator is using SNMP credential only for discovery of a Windows device. How will FortiSIEM handle this?

Question17: Consider the storage of anomaly baseline date that is calculated for different parameters. Which database is used for storing this data?

Question18: An administrator defines SMTP as a critical process on a Linux server.
It the SMTP process is stopped. FortiSIEM will generate a critical event with which event type?

Question19: In the advanced analytical rules engine in FortiSIEM, multiple subpatterms can be referenced using which three operation?(Choose three.)

Question20: What are two tasks that you must do to make a secondary FortiSIEM device ready for disaster recovery? (Choose two.)

Question21: Where do you configure rule notifications and automated remediation on FortiSIEM?

Question22: FortiSIEM is deployed in disaster recovery mode.
When disaster strikes, which two tasks must you perform manually to achieve a successful disaster recovery operation? (Choose two.)

Question23: What are the four possible incident status values?

Question24: Which two FortiSIEM components work together to provide real-time event correlation?

Question25: Refer to the exhibits.


Three events are collected over a 10-minute time period from two servers: Server A and Server B.
Based on the settings tor the rule subpattern. how many incidents will the servers generate?

Question26: Refer to the exhibit.

A FortiSIEM administrator wants to collect both SIEM event logs and performance and availability metrics (PAM) events from a Microsoft Windows server Which protocol should the administrator select in the Access Protocol drop-down list so that FortiSIEM will collect both SIEM and PAM events?

Question27: Which database is used for storing anomaly data, that is calculated for different parameters, such as traffic and device resource usage running averages, and standard deviation values?

Question28: When configuring collectors located in geographically separated sites, what ports must be open on a front end firewall?

Question29: Which FortiSIEM feature must you use to produce a report on which FortiGate devices in your environment are running which firmware version?