Which statement about EPS bursting is true?

FortiSIEM will let you burst up to five times the licensed EPS at any given time, provided it has accumulated enough unused EPS.

FortiSIEM will let you burst up to five times the licensed EPS once during a 24-hour period.

FortiSIEM will let you burst up to five times the licensed EPS at any given time, regardless of unused of EPS.

FortiSIEM must be provisioned with ten percent the licensed EPS to handle potential event surges.

Refer to the exhibit. Which workers are assigned tasks for the query ID 13127? (Choose two.)

Worker1 has no tasks for query ID 13127*.

Worker3 has two tasks for query ID 13127*.

Worker1 has no tasks for query ID 13127*.

Worker1 has one task for query ID 13127*.

Worker2 has two tasks for query ID 13127*.

Worker3 has four tasks for query ID 13127*.

Worker3 has two tasks for query ID 13127*.

What happens to UEBA events when a user is off-net?

The agent will cache events locally if it cannot upload them to a FortiSIEM collector

The agent will drop the events if it cannot upload them to a FortiSIEM collector

The agent will upload the events to the Worker if it cannot upload them to a FortiSIEM collector

The agent will upload the events the events to the Supervisor if it cannot upload them to a FortiSIEM collector

What is the disadvantage of automatic remediation?

It can make a disruptive change to a user, block access to an application, or disconnect critical systems from the network.

External threats or attacks detected by FortiSIEM will need user interaction to take action on an already overworked SOC team.

It is equivalent to running an IPS in monitor-only mode-watches but does not block.

Threat behavior occurring during the night could take hours to respond to.

Which three statements about collector communication with the FortiSIEM cluster are true? (Choose three.)

Collectors communicate periodically with the supervisor node.

The supervisor periodically checks the health of the collector.

Collector upload event data to any node in the worker upload list, but report their health directly to the supervisor node.

Collectors communicate periodically with the supervisor node.

The supervisor periodically checks the health of the collector.

The only communication between the collector and the supervisor is during the registration process.

The supervisor does not initiate any connections to the collector node.

Collector upload event data to any node in the worker upload list, but report their health directly to the supervisor node.

Which two statements about the maximum device limit on FortiSIEM are true? (Choose two.)

The device limit is based on the license type that was purchased from Fortinet.

The device limit is defined for the whole system and is shared by every customer on a service provider edition.

The device limit is based on the license type that was purchased from Fortinet.

The device limit is defined per customer and every customer is assigned a fixed number of device limit by the service provider.

The device limit is only applicable to enterprise edition.

The device limit is defined for the whole system and is shared by every customer on a service provider edition.

Refer to the exhibit. Consider a nested event query where both inner and outer queries are event queries.Reporting IP is selected from the CMDB group Network Device, Event Type is selected from the CMDB group Logon Success, and Source IP is selected from the report Failed Logons to Network Devices.An administrator is about to execute the nested query. The report time ranges must be set before execution. The Nested Time Range will be applied to which attributes?

The nested time range will be configured for the Source IP attribute.

The nested time range will be configured for the Reporting IP attribute.

The nested time range will be configured for the Reporting IP and Event Type attributes.

The nested time range will be configured for the Source IP attribute.

The nested time range will be configured for the Event Type attribute.

Refer to the exhibit. Consider a custom lookup table MalwareIPList. An analyst constructed an analytic query to reference the MalwareIPList lookup table.What is the outcome of the analytic query?

The analyst receives an error because the LookupTableGet function can be used only in display filters to enrich data.

The IP address from permitted traffic with a confidence score of 98 is displayed.

The analyst receives an error because the LookupTableGet function can be used only in display filters to enrich data.

The value for the LookupTableGet function in the analytic search can be either true or false.

The permitted traffic IP address from the Phishing category is displayed.

Which three statements about phRuleMaster are true? (Choose three.)

phRuleMaster is present on the supervisor and workers.

phRuleMaster queues up the data being received from the phRuleWorkers into buckets.

phRuleMaster wakes up to evaluate all the rule data in parallel, every 30seconds.

phRuleMaster is present on the supervisor only.

phRuleMaster is present on the supervisor and workers.

phRuleMaster queues up the data being received from the phRuleWorkers into buckets.

phRuleMaster wakes up to evaluate all the rule data in parallel, every 30seconds.

phRuleMaster wakes up to evaluate all the rule data in series, every 30seconds.

Refer to the exhibit. The service provider deployed FortiSIEM without a collector and added three customers on the supervisor.What mistake did the administrator make?

At least one collector must be deployed to collect logs from service provider infrastructure devices.

The number of workers on the FortiSIEM cluster must match the number of customers added

Collectors must be deployed on all customer premises before they are added to organization on the supervisor.

At least one collector must be deployed to collect logs from service provider infrastructure devices.

Customer A and customer B have overlapping IP addresses.

Refer to the exhibit. If the Z-score for this rule is greater than or equal to three, what does this mean?

The rate firewall connection is above the historical average value.

The rate of firewall connection is below historical average value.

The rate of firewall connection is optimum.

The rate firewall connection is above the historical average value.

The rate of firewall connection is above the current average value.

Refer to the exhibit. An administrator wants to remediate the incident from FortiSIEM shown in the exhibit.What option is available to the administrator?

Run the block domain Windows DNS

Refer to the exhibit. Is the Windows agent delivering event logs correctly?

The agent is not sending logs because it did not receive a monitoring template.

The agent is registered and it is sending logs correctly.

The logs are buffered by the agent and will be sent once the status changes to managed.

Because the agent is unmanaged. the logs are dropped silently by the supervisor.

The agent is not sending logs because it did not receive a monitoring template.

Fortinet FCSS_ADA_AR-6.7 Practice Test 2 - Free Online Exam Prep & Questions

Spam

Selling illegal goods, money scams etc.

Hate Speech

Serious attack on a group.

Harassment and bullying

Harassing an individual (including doxing)

Harmful activities

Threatening or glorifying violence or serious harm, including self-harm

Adult content (Consensual)

Nudity/Sexual content

Sexual exploitation and abuse (child safety)

Sexually explicit or suggestive imagery or writing involving minors

Sexual exploitation and abuse (adults and animals)

Sexually explicit or suggestive imagery or writing involving non-consenting adults or non-humans

Plagiarism

Reusing content without attribution (link and blockquotes)

Poorly written

Not in English or has very bad formatting, grammar, and spelling

Inappropriate credential

Author's credential is offensive, spam, or impersonation

Other

Ex. Illegal content, incomplete question...

Fortinet FCSS_ADA_AR-6.7 Practice Test 2

Question

Fortinet FCSS_ADA_AR-6.7 Practice Tests

Practice Tests