FCSS_ADA_AR-6.7 実際試験問題と解答 - 模擬練習 - 受験自信を増やす

Question No : 1
Refer to the exhibit.

The exhibit shows the output of an SQL command that an administrator ran to view the natural_id value, after logging into the Postgres database.
What does the natural_id value identify?

A.The supervisor
B.The worker
C.An agent
D.The collector

正解:

Question No : 2
Refer to the exhibit.

Which statement about the rule filters events shown in the exhibit is true?

A.The rule filters events with an event type that belong to the Domain Account Locked CMDB group or a reporting IP that belong to the Domain Controller applications group.
B.The rule filters events with an event type that belong to the Domain Account Locked CMDB group and a reporting |P that belong to the Domain Controller applications group.
C.The rule filters events with an event type that belong to the Domain Account Locked CMDB group and a user that belongs to the Domain Controller applications group.
D.The rule filters events with an event type that equals Domain Account Locked and a reporting IP that equals Domain Controller applications.

正解:

Question No : 3
When constructing FortiSIEM baseline rules, what is a primary consideration?

A.Incorporating every possible network event for comprehensive coverage?
B.Designing the rules based on past cybersecurity incidents?
C.Using the average behavior patterns in the network to detect deviations?
D.Mimicking the rules of other similar-sized companies?

正解:

Question No : 4
How can you empower SOC by deploying FortiSOAR? (Choose three.)

A.Aggregate logs from distributed systems
B.Collaborative knowledge sharing
C.Baseline user and traffic behavior
D.Reduce human error
E.Address analyst skills gap

正解:

Question No : 5
The FortiSIEM baseline rules are used to:

A.Establish a standard against which network behaviors are compared?
B.Provide a real-time defense against all cyber threats?
C.Offer a backup solution for network data?
D.Set up firewall rules based on user requests?

正解:

Question No : 6
Which of the following can be an outcome if a FortiSIEM rule detects a suspicious login attempt?

A.Instantly upgrading the FortiSIEM version?
B.Sending an alert to a predefined email address?
C.Automatically opening a support ticket with Fortinet?
D.Changing the passwords of all users in the system?

正解:

Question No : 7
A service provider purchased a licensed EPS of 520 and the total unused events is 72,000. Calculate the total amount of allowed events for the next 3-minute interval.

A.192,456
B.192,442
C.192,446
D.192,450

正解:

Question No : 8
Why can collectors not be defined before the worker upload address is set on the supervisor?

A.Collectors can only upload data to a worker, and the supervisor is not a worker
B.To ensure that the service provider has deployed at least one worker along with a supervisor
C.Collectors receive the worker upload address during the registration process
D.To ensure that the service provider has deployed a NFS server

正解:

Question No : 9
Which three statements about phRuleMaster are true? (Choose three.)

A.phRuleMaster queues up the data being received from the phRuleWorkers into buckets.
B.phRuleMaster is present on the supervisor and workers.
C.phRuleMaster is present on the supervisor only
D.phRuleMaster wakes up to evaluate all the rule data in series, every 30 seconds.
E.phRuleMaster wakes up to evaluate all the rule data in parallel, even/ 30 seconds

正解:

Question No : 10
What is the primary function of FortiSIEM rule processing?

A.To organize logs by timestamp?
B.To determine the actions to take based on observed events?
C.To archive older log entries for storage?
D.To ensure smooth communication between FortiSIEM components?

正解:

Question No : 11
Refer to the exhibit.

Why is the windows device still in the CMDB, even though the administrator uninstalled the windows agent?

A.The device was not uninstalled properly
B.The device must be deleted from backend of FortiSIEM
C.The device has performance jobs assigned
D.The device must be deleted manually from the CMDB

正解:

Question No : 12
How often do collectors upload data to the Supervisor? (Choose two.)

A.Every 20 MB for low EPS environment
B.Every 5 seconds for low EPS environment
C.Every 10 MB for high EPS environment
D.Every 10 seconds for high EPS environment

正解:

Question No : 13
For an MSSP looking to provide SOC solutions to multiple clients, the most scalable and efficient approach would be to:

A.Set up individual SOC environments for each client.
B.Deploy a multi-tenancy SOC solution.
C.Use a single agent across all client networks.
D.Frequently change SOC vendors for the best deals.

正解:

Question No : 14
Refer to the exhibit.

How long has the UEBA agent been operationally down?

A.21 Hours
B.9 Hours
C.20 Hours
D.2 Hours

正解:

Question No : 15
What task does phRuleWorker perform on the worker?

A.Evaluate aggregate condition on a per-rule basis and feed that data to the supervisor node
B.Feed summarized data to the supervisor node based on Group by and filters condition
C.Generate incidents if aggregate conditions calculation matches the value defined in the rule
D.Clear incidents if clear conditions are met

正解:

Fortinet FCSS_ADA_AR-6.7 問題練習