Which statement accurately contrasts lookup tables with watchlists?

Lookup tables can contain multiple columns, whereas watchlists contain only a single column.

Lookup table values age out after a period, whereas watchlist values do not have any time condition.

You can populate lookup tables through an incident, whereas you cannot populate watchlists through an incident.

Lookup tables can contain multiple columns, whereas watchlists contain only a single column.

You can reference lookup table data in analytic queries and reports almost immediately, whereas you may have to wait up to 5-10minutes for watchlist entries to be useable in queries and reports.

How can you empower SOC by deploying FortiSOAR? (Choose three.)

Collaborative knowledge sharing

Aggregate logs from distributed systems

Baseline user and traffic behavior

Refer to the exhibit. Which scenario is not a supported nested query scenario?

The outer query is the CMDB query, and the inner query is the CMDB query.

The outer query is the event query, and the inner query is the event query.

The outer query is the event query, and the inner query is the CMDB query.

The outer query is the CMDB query, and the inner query is the event query.

The outer query is the CMDB query, and the inner query is the CMDB query.

When you perform a Group By on a structured query, which two outcomes occur? (Choose two.)

Group By automatically applies a COUNT aggregation.

Group By is applied to real-time and historical searches.

Group By automatically applies a COUNT aggregation.

Group By is applied to real-time and historical searches.

Group By cannot be applied to an aggregated function.

Group By is applied to historical searches only.

Refer to the exhibit. Which statement about the rule filters events shown in the exhibit is true?

The rule filters events with an event type that belong to the Domain Account Locked CMDB group and a reporting IP that belong to the Domain Controller applications group.

The rule filters events with an event type that equals Domain Account Locked and a reporting IP that equals Domain Controller applications.

The rule filters events with an event type that belong to the Domain Account Locked CMDB group or a reporting IP that belong to the Domain Controller applications group.

The rule filters events with an event type that belong to the Domain Account Locked CMDB group and a reporting IP that belong to the Domain Controller applications group.

The rule filters events with an event type that belong to the Domain Account Locked CMDB group and a user that belongs to the Domain Controller applications group.

Refer to the exhibit. Why was this incident auto cleared?

Within five minutes, the packet loss percentage dropped to a level where the host IP of the original rule matches the host IP of the clear condition pattern

Within five minutes the packet loss percentage dropped to a level where the reporting IP is the same as the host IP

The original rule did not trigger within five minutes

Within five minutes, the packet loss percentage dropped to a level where the reporting IP is same as the source IP

Refer to the exhibit. An administrator applies the rule exception shown in the exhibit.How does this configuration impact the incident generation for that rule?

Incidents will not be generated during the specified period.

Incidents will be generated only during the specified period.

Incidents will be generated without triggering an email alert during the specified period.

Events will not be processed by the rule during the specified period.

Which two statements about phRuleWorker are true? (Choose two.)

phRuleWorker uses a 60-second bucket as an evaluation window.

phRuleWorker exists on both the supervisor and workers.

phRuleWorker uses a 60-second bucket as an evaluation window.

phRuleWorker evaluates non-aggregate conditions as defined in subpattern filters of a rule in memory.

phRuleWorker exists on both the supervisor and workers.

phRuleWorker exists on the worker only.

FortiSIEM provides all rules with the ability to automatically change an active incident status to auto-cleared, based on an extra set of defined criteria.Why would you configure FortiSIEM to automatically change an active incident status to auto-cleared?

Because availability or performance-related problems may trigger a threshold temporarily.

Because too many active incidents can spike the resource usaqe on FortiSIEM.

Because you need a way to reduce a backlog of incident responses.

Because some security-related incidents occur on a temporary basis.

For what type of data values does the rule engine query the profile database?

Statistical average and/or standard deviation values for the current hour of the day

High and/or low values for the current hour of the day

Minimum and/or maximum values for the current hour of the day

First and/or last values for the current hour of the day

Statistical average and/or standard deviation values for the current hour of the day

Which organization do agents belong to after registration? (Choose two.)

The agents belong to the organization specified in the agent installation setup wizard for Windows platforms.

The agents belong to the organization specified in the command line parameters for Linux platforms.

The windows agents belong to the super organization.

The agents belong to the organization specified in the agent installation setup wizard for Windows platforms.

The Linux agents belong to the super local organization.

The agents belong to the organization specified in the command line parameters for Linux platforms.

What is the hourly bucket used in baselining?

To store data for specific baselines for every hour of the day during weekdays and weekends

To store hourly baselines reports for every hour of the day during weekdays and weekends

To store data for specific baselines during the weekend, if there is a spike in network activity

To store data for specific baselines during peak business hours of weekdays

To store data for specific baselines for every hour of the day during weekdays and weekends

What are two functions of numpoints in a rule and profile database? (Choose two.)

To prevent premature triggering of a rule before a baseline is set and becomes active

To fetch only values from the profile database that have numPoints greater than a certain threshold

To prevent premature triggering of a rule before a baseline is set and becomes active

To ensure that the data points do not exceed a threshold value

To fetch only values from the profile database that have numPoints greater than a certain threshold

To track the hour of the day for each data value

How do customers connect to a shared multi-tenant instance on FortiSOAR?

The MSSP must provide secure network connectivity between the FortiSOAR manager node and the customer devices.

The customer must install a tenant node to connect to the MSSP shared multi-tenant instance.

The MSSP must provide secure network connectivity between the FortiSOAR manager node and the customer devices.

The MSSP must install a Secure Message Exchange node to connect to the customer's shared multi-tenant instance.

The MSSP must install an agent node on the customer's network to connect to the customer's shared multi-tenant instance.

How can you customize the AI model on FortiSIEM?

Adjust risk weighting for UEBA tags

Adjust number of samples collected by the UEBA agents

Refer to the exhibit. Which deployment type is shown in the exhibit?

Hybrid deployment with and without collectors

Service provider with collectors

Service provider without collectors

Hybrid deployment with and without collectors

Refer to the exhibit. What are three possible reasons why the Agent Status displays Running Inactive? (Choose three.)

The agent was registered incorrectly

The collector was not assigned to the agent

What happens to events that the collector receives when there is a WAN link failure between the collector and the supervisor?

Events are buffered up to 1 GB after compression.

Events are buffered for up to 24 hours.

Events are buffered up to 10 MB before compression.

Events are buffered up to 10.000 logs.

Events are buffered up to 1 GB after compression.

Refer to the exhibit. The collector is registered and has pulled the license file from the supervisor.What are the consequences of removing the license file?

The collector must be re-registered with the supervisor to get the license file back.

The collector processes will go down.

The collector must be redeployed to get the license file back.

The license file must be pushed manually from the supervisor.

Why do collectors communicate with the Supervisor after registration? (Choose two.)

To upload event data if a worker down

To report its own health status

To receive templates associated with agents

To report the health status of the agents

To upload event data if a worker down

To report its own health status

Refer to the exhibit. A service provider does not have a dedicated worker in the cluster, but still wants to add a collector to an organization.What option does the administrator have?

Define the supervisor IP address as a worker unload address

Define a pseudo address as a worker IP address

Ignore the warning and continue adding the collector

Define the supervisor IP address as a worker unload address

Refer to the exhibit. Why is the windows device still in the CMDB, even though the administrator uninstalled the windows agent?

The device must be deleted manually from the CMDB

The device must be deleted from backend of FortiSIEM

The device has performance jobs assigned

The device was not installed properly

The device must be deleted manually from the CMDB

Refer to the exhibit. An administrator deploys a new collector for the first time, and notices that all the processes expect the phMonitor are down.How can the administrator bring the processes up?

The processes will come up after the collector is registered to the supervisor.

The collector was not deployed properly and must be redeployed.

The administrator needs to run the command phtools - start all on the collector.

Rebooting the collector will bring up the processes.

The processes will come up after the collector is registered to the supervisor.

Which syntax will register a collector to the supervisor?

phProvisionCollector -add <user><super IP><organization><workerName>

phProvisionCollector -add <user><super ID><organization><collectorName>

phProvisionCollector -add <user><collector IP><organizationid><collectorName>

phProvisionCollector -add <user><super IP><organization><workerName>

phProvisionCollector -add <user><collector IP><organization><superName>

How can you invoke an integration policy on FortiSIEM rules?

Through Notification Policy settings

Through External Authentication settings

Through Incident Notification settings

Why can collectors not be defined before the worker upload address is set on the supervisor?

Collectors receive the worker upload address during the registration process

To ensure that the service provider has deployed a NFS server

Collectors can only upload data to a worker, and the supervisor is not a worker

To ensure that the service provider has deployed at least one worker along with a supervisor

Refer to the exhibit. The profile database contains CPU utilization values from day one. At midnight on the second day, the CPU utilization values from the daily database will be merged with the profile database.In the profile database, in the Hour of Day column where 9 is the value, what will be the updated minimum, maximum, and average CPU utilization values?

Min CPU Util=32.31, Max CPUUtil=33.50 and AVG CPUUtil=32.67

Min CPU Util=32.31, Max CPUUtil=32.31 and AVG CPUUtil=32.31

Min CPU Util=32.31, Max CPUUtil=33.50 and AVG CPUUtil 33.50

Min CPU Util=33.50, Max CPUUtil=33.50 and AVG CPUUtil=33.50

Refer to the exhibit. The window for this rule is 30minutes.What is this rule tracking?

A sudden 150% increase in WMI response times over a 30-minute time window

A sudden 50% increase in WMI response times over a 30-minute time window

A sudden 1.50 times increase in WMI response times over a 30-minute time window

A sudden 150% increase in WMI response times over a 30-minute time window

A sudden 75% increase in WMI response times over a 30-minute time window

Fortinet FCSS_ADA_AR-6.7 Practice Test 1 - Free Online Exam Prep & Questions

Question 1 / 40

A service provider purchases a licensed EPS of 520. The guaranteed EPS allocated to three customers is 50, 100, and 150 respectively. At the end of every three-minute interval, incoming EPS is calculated at every collector and the value is sent to the central decision-making engine on the supervisor node.

The incoming EPS for the first collector is 25. the incoming EPS for the second collector is 50, and the incoming EPS for the third collector is 75.

Based on the information provided, what is the unused events total calculated by the supervisor?

76.000

35.960

75.960

71.460

Comment (0)

Fortinet FCSS_ADA_AR-6.7 Practice Test 1

Question

Fortinet FCSS_ADA_AR-6.7 Practice Tests

Practice Tests