Summer Certification Limited Time 70% Discount Offer - Ends in 0d 00h 00m 00s - Coupon code = getmirror

Home
Fortinet
Fortinet Certified Professional Security Operations
FCSS_ADA_AR-6.7
FCSS Advanced Analytics 6.7 Architect Questions and Answers

Pass the Fortinet Certified Professional Security Operations FCSS_ADA_AR-6.7 Questions and answers with ExamsMirror

Practice at least 50% of the questions to maximize your chances of passing.

Exam FCSS_ADA_AR-6.7 Premium Access

View all detail and faqs for the FCSS_ADA_AR-6.7 exam

Go to Exam

836 Students Passed

93% Average Score

90% Same Questions

Viewing page 2 out of 2 pages

Viewing questions 11-20 out of questions

Questions # 11:

From where does the rule engine load the baseline data values?

Options:

The memory

The profile report

The profile database

The daily database

Answer

Explanation

The rule engine in FortiSIEM loads baseline data values from the profile database. This database stores historical trends and behavioral baselines for various metrics, such as CPU usage, network activity, and authentication patterns.

● Profile database maintains long-term aggregated statistics for anomaly detection.

● Baseline values are used to compare current events against expected behavior.

● This helps in detecting deviations, such as a sudden increase in failed logins or unusual traffic spikes.

Questions # 12:

Which two statements about phRuleWorker are true? (Choose two.)

Options:

phRuleWorker uses a 60-second bucket as an evaluation window.

phRuleWorker evaluates non-aggregate conditions as defined in subpattern filters of a rule in memory.

phRuleWorker exists on both the supervisor and workers.

phRuleWorker exists on the worker only.

Answer

A, C

Explanation

phRuleWorker processes events in 60-second intervals (buckets). This means that events within a one-minute window are evaluated together for rule conditions, helping detect patterns, correlations, and triggers.

phRuleWorker runs both on the supervisor and worker nodes to distribute event processing. The supervisor primarily orchestrates rule evaluation, while workers handle distributed event processing.

Questions # 13:

Refer to the exhibit.

Question # 13

The service provider deployed FortiSIEM without a collector and added three customers on the supervisor.

What mistake did the administrator make?

Options:

The number of workers on the FortiSIEM cluster must match the number of customers added

Collectors must be deployed on all customer premises before they are added to organization on the supervisor.

At least one collector must be deployed to collect logs from service provider infrastructure devices.

Customer A and customer B have overlapping IP addresses.

Answer

Explanation

The administrator deployed FortiSIEM without a collector, meaning there is no dedicated system collecting logs from service provider infrastructure devices. Without a collector, the FortiSIEM supervisor and workers must directly ingest logs, which is not ideal for a multi-tenant service provider setup. A collector is necessary to efficiently gather logs before forwarding them to the FortiSIEM cluster.

Questions # 14:

Refer to the exhibit.

Question # 14

This is an example of a baseline profile that is configured in the backend of FortiSIEM.

Which two Group By attributes are configured for this profile? (Choose two.)

Options:

Logon Failure

Reporting Device

Reporting IP

Distinct User

Answer

B, C

Explanation

From the provided XML configuration, we need to focus on the section, which defines the attributes used for grouping.

In the SelectClause, the following attributes are listed:

reptDevName, reptDevAddr, COUNT(*), COUNT(DISTINCT user), COUNT(DISTINCT srcIpAddr)

● reptDevName represents the reporting device.

● reptDevAddr represents the reporting IP.

● COUNT(DISTINCT user) tracks unique users.

● COUNT(DISTINCT srcIpAddr) tracks distinct source IPs.

In the GroupByAttr section:

reptDevName, reptDevAddr

This confirms that the grouping is performed by Reporting Device (reptDevName) and Reporting IP (reptDevAddr).

Questions # 15:

Refer to the exhibit.

Question # 15

If the Z-score for this rule is greater than or equal to three, what does this mean?

Options:

The rate of firewall connection is below historical average value.

The rate of firewall connection is optimum.

The rate firewall connection is above the historical average value.

The rate of firewall connection is above the current average value.

Answer

Explanation

The Z-score formula in the expression builder calculates how many standard deviations the current value is from the historical average. The formula used is:

AVG(Firewall Session) represents the current firewall session rate.

STAT_AVG(AVG(Firewall Session);112) represents the historical average over a 112-time unit window.

STAT_STDDEV(AVG(Firewall Session);112) represents the historical standard deviation over the same period.

A Z-score ≥ 3 indicates that the current firewall session rate is significantly higher than the historical average (3 standard deviations above the mean), signaling an anomaly.

Questions # 16:

FortiSIEM provides all rules with the ability to automatically change an active incident status to auto-cleared, based on an extra set of defined criteria.

Why would you configure FortiSIEM to automatically change an active incident status to auto-cleared?

Options:

Because availability or performance-related problems may trigger a threshold temporarily.

Because too many active incidents can spike the resource usaqe on FortiSIEM.

Because you need a way to reduce a backlog of incident responses.

Because some security-related incidents occur on a temporary basis.

Answer

Explanation

In FortiSIEM, some incidents may be triggered due to temporary threshold breaches, especially in availability or performance-related monitoring. These temporary anomalies do not necessarily indicate a persistent issue or security threat.

By automatically clearing such incidents, FortiSIEM prevents unnecessary manual intervention and reduces noise in incident management.

Questions # 17:

Refer to the exhibit.

Question # 17

Is the Windows agent delivering event logs correctly?

Options:

The agent is registered and it is sending logs correctly.

The logs are buffered by the agent and will be sent once the status changes to managed.

Because the agent is unmanaged. the logs are dropped silently by the supervisor.

The agent is not sending logs because it did not receive a monitoring template.

Answer

Explanation

The Windows agent (fortibank_dc.fortibank.net) is in an "Unmanaged" state, which indicates that it has not received a monitoring template from FortiSIEM. Without a template, the agent does not know what logs to collect or forward, meaning it is not sending logs to the supervisor.

The agent is registered, meaning it has completed the installation and connection process. Since it is unmanaged, it is not actively monitored or configured to send logs. To resolve this, the administrator must assign a monitoring template to enable proper log forwarding.

Viewing page 2 out of 2 pages

Viewing questions 11-20 out of questions