A support agent resolves an incident associated with an alert, but the alert does automatically close even though the evt_mgmt.incident_closes_alert property is set appropriately to close the alert.
What is the most likely cause of this issue?
Suggested Answer: A
Get Premium CIS-EM Questions
as Interactive Web-Based Practice Test or PDF
Real Exam Format
Detailed Explanations
Instant Access
Get Your Practice Test
27 comments · newest first
HO
Hobert
3 days ago
B is unlikely. Admins usually have broader permissions.
DE
Dexter
8 days ago
A makes sense. Roles are crucial for closing alerts properly.
JA
Jamie
14 days ago
I disagree, D seems off. If they lack operator role, it could be an issue.
GL
Glory
19 days ago
I lean towards D. Having the user role should be enough, right?
MA
Marti
24 days ago
I feel like it's C. The operator role might not have enough permissions.
VI
Vincenza
29 days ago
I think it's A. Without the evt_mgmt_user role, the agent can't close alerts.
VA
Vanesa
1 month ago
I think A is unlikely. They need some role to close alerts.
SA
Sabra
1 month ago
I’m torn between C and D. Both have valid points.
TO
Tora
1 month ago
But without operator, it might not work. C is safer.
AL
Alison
2 months ago
What about D? User role should help, right?
CE
Cecily
2 months ago
I agree, C makes sense. No user role means no alert closure.
FA
Fanny
2 months ago
I lean towards option C. The operator role seems limiting.
RO
Rosalia
2 months ago
Yeah, I feel like it’s definitely role-related.
YA
Yan
2 months ago
This question is tricky. I think it's about roles.
RO
Roxanne
3 months ago
B seems unlikely, admin usually has broader access.
TR
Tracie
3 months ago
Definitely not A, the user role is needed for closing alerts.
HE
Herminia
3 months ago
Wait, how can the alert not close if the property is set right? Sounds odd.
DO
Dorcas
3 months ago
I disagree, it could be option D. The user role alone might not be enough.
HA
Haley
3 months ago
I think it's option C. The operator role might not have the right permissions.
CA
Carri
3 months ago
I’m leaning towards option C, but I’m not entirely confident. It seems like having both roles might be essential for the alert to close automatically.
SU
Susana
4 months ago
I feel like the evt_mgmt_user role is important, but I can't recall if the evt_mgmt_operator role is also necessary for closing alerts.
WI
Willetta
4 months ago
I think we practiced a similar question where the role permissions were key. Maybe it's about not having the right combination of roles?
DI
Dierdre
4 months ago
I remember something about roles affecting alert management, but I'm not sure which one is critical for closing alerts.
LE
Lenna
4 months ago
I think if the agent has the evt_mgmt_admin role, it might not be enough to close alerts. I need to double-check that.
HY
Hyman
6 months ago
I feel like the evt_mgmt_user role is important, but I can't recall if the operator role is also necessary for closing alerts.
KA
Kathrine
6 months ago
This seems similar to a practice question we did on user roles. I think having the right combination is key here.
LI
Lindy
6 months ago
I remember something about roles affecting alert management, but I'm not sure which one is crucial for closing alerts.