CIS-EM Online Practice Questions and Answers

Within an event rule, how would you parse a nodename out of your raw event data?

A. JavaScript

B. Groovy script

C. PowerShell script

D. Regex statement

If events are not matching to alerts as you would like, what field should be changed?

A. Resource

B. Message Key

C. Node

D. Metric Name

Which is the best option to reduce latency issues when receiving events?

A. Verify bucket field in em_event table > 0

B. Verify event_processor_job_count = 2

C. Verify event_processor_job_count = 0

D. Verify event_processor_enable_multi_node = 2

Applying recommended Event Management best practice guidelines, which of the following events should generate an alert?

A. Every event should generate an alert so you have the opportunity to resolve them all.

B. Only events that necessitate action should generate an alert.

C. Only the most critical events on every CI in the CMDB should generate an alert.

D. Every event on every critical CI in the CMDB should generate an alert.

Processing on an event will create a state of error if what value is not set?

A. Node

B. Source

C. Severity

D. Message Key

E. Resource

A support agent resolves an incident associated with an alert. What is the best method to close the alert?

A. Set the evt_mgmt.incident_closes_alert

B. Set the evt_mgmt.alert_closes_incident

C. Switch over to the alert form and close the alert manually

D. Create a business rule on the alert table to match the associated Incident with its respective alert

E. Create a business rule on the incident table

What Event Management module allows for configuration of automatic task creation?

A. Alert management rules

B. Task rules

C. Event rules

D. Alert correlation rules

What is the minimum role needed to view alerts?

A. alert_operator

B. evt_mgmt_user

C. evt_mgmt_operator

D. alert_user

What would be the primary use case for creating Javascripts in Event Management?

A. To create a customized pull connector to retrieve events on behalf of an event source

B. To automatically populate the Configuration Management Database (CMDB)

C. To parse a nodename out of your raw event data in an event rule

D. To run as part of a remediation workflow for IT alerts that fail to execute

Which attribute correlates multiple events to one alert?

A. Additional_info

B. Message_key

C. Metric_name

D. Short_description

Which is an invalid state for an alert?

A. Flapping

B. Closed

C. Reopen

D. Processed

What three areas of data quality does the CMDB Health Dashboard focus on? (Choose three.)

A. Correctness

B. Completeness

C. Configuration

D. Conciseness

E. Conformity

F. Compliance

Modified Agent Client Collector policies do not take effect until what action is taken?

A. The check is tested on an existing agent/host

B. The policy is republished

C. Agents re-run the discovery policy

D. MID server synchronization is initiated

E. Agents are restarted

If more than one alert management rule applies to a particular alert, which of the rules will run based upon the Order of execution field?

A. Only the alert management rule with the highest Order of execution number will run.

B. Only the alert management rule with the lowest Order of execution number will run.

C. All alert management rules will run, from the lowest to the highest Order of execution numbers.

D. All alert management rules will run, from the highest to the lowest Order of execution numbers.

HOTSPOT

In what sequence are events processed?

Hot Area: