Question 1

Refer to the exhibit.

Which statement about the rule filters events shown in the exhibit is true?

Options :

A :

The rule filters events with an event type that equals Domain Account Locked and a reporting IP that equals Domain Controller applications.

B :

The rule filters events with an event type that belong to the Domain Account Locked CMDB group or a reporting IP that belong to the Domain Controller applications group.

C :

The rule filters events with an event type that belong to the Domain Account Locked CMDB group and a reporting IP that belong to the Domain Controller applications group.

D :

The rule filters events with an event type that belong to the Domain Account Locked CMDB group and a user that belongs to the Domain Controller applications group.

Answer: C

Question 2

Refer to the exhibit.

Consider a nested event query where both inner and outer queries are event queries. Reporting IP is selected from the CMDB group Network Device, Event Type is selected from the CMDB group Logon Success, and Source IP is selected from the report Failed Logons to Network Devices. An administrator is about to execute the nested query. The report time ranges must be set before execution. The Nested Time Range will be applied to which attributes?

Options :

A : The nested time range will be configured for the Reporting IP attribute.

B : The nested time range will be configured for the Reporting IP and Event Type attributes.

C : The nested time range will be configured for the Source IP attribute.

D : The nested time range will be configured for the Event Type attribute.

Answer: C

Question 3

What are two reasons that agents maintain communication with the supervisor after registration? (Choose two.)

Options :

A : To collect new agent template

B : To report health and its status

C : To report incoming EPS value

D : To report logs and events

Answer: A,B

Question 4

A service provider purchased a licensed EPS of 520 and the total unused events is 72,000. Calculate the total amount of allowed events for the next 3-minute interval.

Options :

A : 192,456

B : 192,442

C : 192,446

D : 192,450

Answer: A

Question 5

What is the primary function of FortiSIEM rule processing?

Options :

A : To archive older log entries for storage?

B : To ensure smooth communication between FortiSIEM components?

C : To organize logs by timestamp?

D : To determine the actions to take based on observed events?

Answer: D

Confidently Practice Online with Free FCSS_ADA_AR-6.7 Exam Cram

Buying Options: