9% of the exam — the smallest of the first four domains.
3 sub-topics · this deck covers sub-topic 2 of 3
↑ Module 1 OverviewKnowing the System Log exists is one thing. Actually finding the one event you need inside thousands is the real skill this bullet tests.
The System Log's Filters & Search view lets you narrow results by parameter: time range, event info, actor, and target.
This is distinct from just scrolling the Events Table — filtering means constructing a targeted query instead of manually scanning a default 7-day window of everything.
Okta's own documentation points to two companion resources for this exact skill: the Event Types API reference (the full catalog of possible event type values you'd filter on) and dedicated guidance on System Log filters and common filter examples.
In practice, filtering well means knowing which event type you're looking for — which is why the event-type catalog matters as much as the filter mechanism itself.
Watch for scenario questions built around this framing:
→ "An admin needs to find all failed MFA attempts for a specific user in the last 24 hours." = filter by actor + event info + a tightened time range, not manual scrolling.
Sources: help.okta.com — Reports_SysLog.htm
Next: Sub 3 →