MENU
If events are not matching to alerts as you would like, what field should be changed?
Suggested Answer: D
Get Premium CIS-EM Questions
as Interactive Web-Based Practice Test or PDF
Real Exam Format
Detailed Explanations
Instant Access
Get Your Practice Test
17 comments · newest first
JU
Juan
11 months ago
I doubt any of these will fix the issue.
ME
Merlyn
11 months ago
Wait, are we sure it's not the Node?
RO
Rodolfo
11 months ago
Changing the Resource could help too.
AM
Ammie
12 months ago
No way, it has to be the Metric Name!
LE
Leatha
12 months ago
I think it's definitely the Message Key.
LO
Lorenza
1 year ago
I’m leaning towards Message Key too, but I wish I had more clarity from our last practice exam.
EL
Elbert
1 year ago
I feel like Node could be the right answer, but I also have a nagging feeling about Metric Name.
EM
Emogene
1 year ago
I remember discussing the importance of the Resource field, but I can't recall if it was specifically for alerts.
RY
Ryan
1 year ago
I think it might be the Message Key, but I'm not entirely sure. We practiced something similar in class.
EL
Ellsworth
1 year ago
Ah, I think I know the answer! If the events and alerts aren't lining up, the field that should be changed is the Resource. That's the identifier that connects the two, so that's where I'd focus my attention.
CR
Crista
1 year ago
I'm a little confused on this one. I'm not sure which field would be the best to change if the events and alerts aren't matching up. I'll need to re-read the relevant section in the study guide.
ST
Stefany
1 year ago
I've got this! The field that needs to be changed is the Message Key. That's the key piece of information that links the events to the alerts.
UN
Una
1 year ago
Okay, let me see... I'm pretty sure the answer has to do with the way the events and alerts are being correlated. I'll need to review that part of the material.
MA
Marla
1 year ago
Hmm, this seems like a tricky one. I'll need to think carefully about the different fields that could be involved in matching events to alerts.
JO
Jonell
1 year ago
Hmm, I'm a little confused by this one. I'm not sure if the "Current User" filter just looks for the literal text "Current User" in the Policy Owner field, or if it actually filters based on the user running the search. I'll have to think this through carefully.
BE
Beata
1 year ago
Hmm, I'm a bit unsure about this one. The options seem to cover a range of different accounting policy disclosures, and I'll need to make sure I understand the requirements for each. I'll need to review my notes to refresh my memory on the relevant accounting standards.
AR
Arlen
1 year ago
Hmm, I'm a bit unsure about this one. The diagram doesn't provide a lot of detail, and I'm not sure which location would be the best for the IDS sensor. I'll have to think it through step-by-step.