試験3V0-22.25 トピック1 問題6 スレッド

The administrator should first locate the relevant VM compliance alert by filtering the VM's alert list using Alert Subtype = Compliance . Compliance benchmark violations are implemented as alert definitions and symptoms, so filtering by compliance subtype narrows the alert list to the correct class of benchmark findings.
After opening the alert, the administrator should inspect the alert evidence and specifically expand Alert Basis
. Broadcom documents that Alert Basis shows the active symptoms or conditions that were met for the alert when Active Only is enabled, which directly identifies the symptom or symptoms that triggered the compliance violation ( TechDocs ). The Potential Evidence view is also part of the alert investigation workflow and exposes supporting evidence around the alert, including the basis used to explain why the alert fired ( TechDocs ). Related Alerts is not the correct place to identify the triggering symptom; it shows other correlated alerts. Object Type = Compliance is invalid because compliance is an alert subtype, not a VM object type. Go to Alert Definition shows the configured definition, but not necessarily which symptoms were active on that VM at trigger time. Reference topic: Objective 4.16 - Compliance Benchmarks / CIS Security Standards / Alert Basis and Triggered Symptoms .