Configure Native File Auditing or Auditing with an External FPolicy Server CERTIFIED-CYBER-RESILIENCY-EXPERT Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A company has enabled native file auditing on their ONTAP SVM. They notice that the audit log is growing rapidly and filling up the audit log volume. What should the administrator do to manage the log size?

   • AIncrease the size of the audit log volume and configure log rotation.
   • BDisable auditing for less critical volumes to reduce the number of events logged.
   • CSet the audit log to overwrite old events when the volume is full.
   • DConfigure the audit log to be written to a remote syslog server instead of the local volume.
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   Which ONTAP CLI command is used to display native file auditing events?

   • Avserver fpolicy show-events
   • Bvserver audit log-forwarding show
   • Cvserver audit show
   • Dvserver audit log show
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   What is the default destination for native file auditing events in ONTAP?

   • AExternal FPolicy server
   • BEvent Management System (EMS)
   • CAudit log files on the SVM root volume
   • DSyslog server
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   A company has both native file auditing and an external FPolicy server configured on their ONTAP system. They are seeing duplicate audit events for the same file access. The security team wants to eliminate the duplicates to simplify reporting. What should the administrator do?

   • ADisable native file auditing and rely solely on the external FPolicy server for audit events.
   • BConfigure the FPolicy policy to filter out events that are already captured by native auditing.
   • CDisable the external FPolicy server and rely solely on native file auditing.
   • DKeep both auditing methods and use a SIEM to deduplicate events during reporting.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A company has native file auditing enabled on their ONTAP system. The security team needs to review audit logs for a specific user's activity over the past week. What is the most efficient way to do this?

   • AConfigure an external FPolicy server to send events to a SIEM and query the SIEM for the user's activity.
   • BExport the entire audit log to a CSV file and use a spreadsheet to filter for the user.
   • CUse the ONTAP System Manager to view the audit log and manually scroll through events.
   • DUse the ONTAP CLI to search the audit log for events associated with the user's account.
   Reveal Solution Discussion Select an answer first