Question 1

UEBA in the context of FortiSIEM stands for:

Options :

A : User and Entity Behavior Analytics?

B : User Event Baseline Algorithm?

C : Unified Endpoint Baseline Assessment?

D : Unified Encryption Behavior Analysis?

Answer: A

Question 2

Refer to the exhibit.

Why was this incident auto cleared?

Options :

A :

Within five minutes, the packet loss percentage dropped to a level where the host IP of the original rule matches the host IP of the clear condition pattern

B :

Within five minutes the packet loss percentage dropped to a level where the reporting IP is the same as the host IP

C : The original rule did not trigger within five minutes

D :

Within five minutes, the packet loss percentage dropped to a level where the reporting IP is same as the source IP

Answer: A

Question 3

What happens to UEBA events when a user is off-net?

Options :

A : The agent will upload the events to the Worker if it cannot upload them to a FortiSIEM collector

B : The agent will upload the events to the Supervisor if it cannot upload them to a FortiSIEM collector

C : The agent will cache events locally if it cannot upload them to a FortiSIEM collector

D : The agent will drop the events if it cannot upload them to a FortiSIEM collector

Answer: C

Question 4

What is the primary function of FortiSIEM rule processing?

Options :

A : To archive older log entries for storage?

B : To ensure smooth communication between FortiSIEM components?

C : To organize logs by timestamp?

D : To determine the actions to take based on observed events?

Answer: D

Question 5

Which statement accurately contrasts lookup tables with watchlists?

Options :

A : Lookup table values age out after a period, whereas watchlist values do not have any time condition.

B : You can populate lookup tables through an incident, whereas you cannot populate watchlists through an incident.

C : Lookup tables can contain multiple columns, whereas watchlists contain only a single column.

D :

You can reference lookup table data in analytic queries and reports almost immediately, whereas you may have to wait up to 5-10 minutes for watchlist entries to be useable in queries and reports.

Answer: C

Free FCSS_ADA_AR-6.7 Mock Exam – Practice Online Confidently

Buying Options: