Question 1

What are the two SQLite databases that are used for baseline data? (Choose two.)

Options :

A : Event database

B : Daily database

C : Weekly database

D : Profile database

Answer: B,D

Question 2

What is the primary function of FortiSIEM rule processing?

Options :

A : To archive older log entries for storage?

B : To ensure smooth communication between FortiSIEM components?

C : To organize logs by timestamp?

D : To determine the actions to take based on observed events?

Answer: D

Question 3

Refer to the exhibit.

Which statement about the rule filters events shown in the exhibit is true?

Options :

A :

The rule filters events with an event type that equals Domain Account Locked and a reporting IP that equals Domain Controller applications.

B :

The rule filters events with an event type that belong to the Domain Account Locked CMDB group or a reporting IP that belong to the Domain Controller applications group.

C :

The rule filters events with an event type that belong to the Domain Account Locked CMDB group and a reporting IP that belong to the Domain Controller applications group.

D :

The rule filters events with an event type that belong to the Domain Account Locked CMDB group and a user that belongs to the Domain Controller applications group.

Answer: C

Question 4

What are two reasons that agents maintain communication with the supervisor after registration? (Choose two.)

Options :

A : To collect new agent template

B : To report health and its status

C : To report incoming EPS value

D : To report logs and events

Answer: A,B

Question 5

Which statement accurately contrasts lookup tables with watchlists?

Options :

A : Lookup table values age out after a period, whereas watchlist values do not have any time condition.

B : You can populate lookup tables through an incident, whereas you cannot populate watchlists through an incident.

C : Lookup tables can contain multiple columns, whereas watchlists contain only a single column.

D :

You can reference lookup table data in analytic queries and reports almost immediately, whereas you may have to wait up to 5-10 minutes for watchlist entries to be useable in queries and reports.

Answer: C

Confidently Practice Online with Free FCSS_ADA_AR-6.7 Exam Cram

Buying Options: