ExamGecko
Search Search Login
Home Home / Fortinet / NSE7_ADA-6.3
Question list
Search
Search
Open VPLUS File
Convert VPLUS to PDF

Related questions

What is Tactic in the MITRE ATT&CK framework?
Which two statements about the maximum device limit on FortiSIEM are true? (Choose two.)
On which disk are the SQLite databases that are used for the baselining stored?
Identify the processes associated with Machine Learning/Al on FortiSIEM. (Choose two.)
Refer to the exhibit. The rule evaluates multiple VPN logon failures within a ten-minute window. Consider the following VPN failure events received within a ten-minute window: How many incidents are generated?
Which statement about EPS bursting is true?
Which three processes are collector processes? (Choose three.)
Refer to the exhibit. Which statement about the rule filters events shown in the exhibit is true?
Which three statements about phRuleMaster are true? (Choose three.)
Refer to the exhibit. An administrator deploys a new collector for the first time, and notices that all the processes except the phMonitor are down. How can the administrator bring the processes up?

Question 18 - NSE7_ADA-6.3 discussion

Report
Export

What happens to UEBA events when a user is off-net?

A.
The agent will upload the events to the Worker if it cannot upload them to a FortiSIEM collector
Answers
A.
The agent will upload the events to the Worker if it cannot upload them to a FortiSIEM collector
B.
The agent will cache events locally if it cannot upload them to a FortiSIEM collector
Answers
B.
The agent will cache events locally if it cannot upload them to a FortiSIEM collector
C.
The agent will upload the events to the Supervisor if it cannot upload them to a FortiSIEM collector
Answers
C.
The agent will upload the events to the Supervisor if it cannot upload them to a FortiSIEM collector
D.
The agent will drop the events if it cannot upload them to a FortiSIEM collector
Answers
D.
The agent will drop the events if it cannot upload them to a FortiSIEM collector
Suggested answer: B

Explanation:

When a user is off-net, meaning they are not connected to a network where a FortiSIEM collector is reachable, then UEBA events will be cached locally by the agent if it cannot upload them to a FortiSIEM collector. The agent will store up to 100 MB of events in a local database file and try to upload them when it detects a network change or every five minutes.

Show Answer
asked 18/09/2024
Sumit Dhar
47 questions
PreviousPreviousNextNext
User
Your answer:
0 comments
Sorted by

Leave a comment first

ExamGecko

Copyright @2023 ExamGecko | All right reserved

Mail us: [email protected]
About us
Contact us
Twitter X
Facebook
Medium
Convert VPLUS to PDF
Open VPLUS files Easily and Quickly
Privacy Policy
Disclaimer
Terms