Question 1

For effective rule construction in FortiSIEM, it's essential to consider:

Options :

A : The expected behavior of users in the network?

B : The specific brands of devices in the environment?

C : Known patterns of malicious activities?

D : The latest threats detailed in the MITRE ATT&CK® framework?

Answer: A,C,D

Question 2

Refer to the exhibit.

Which statement about the rule filters events shown in the exhibit is true?

Options :

A :

The rule filters events with an event type that equals Domain Account Locked and a reporting IP that equals Domain Controller applications.

B :

The rule filters events with an event type that belong to the Domain Account Locked CMDB group or a reporting IP that belong to the Domain Controller applications group.

C :

The rule filters events with an event type that belong to the Domain Account Locked CMDB group and a reporting IP that belong to the Domain Controller applications group.

D :

The rule filters events with an event type that belong to the Domain Account Locked CMDB group and a user that belongs to the Domain Controller applications group.

Answer: C

Question 3

Refer to the exhibit.

This is an example of a baseline profile that is configured in the backend of FortiSIEM. Which two Group By attributes are configured for this profile? (Choose two.)

Options :

A : Logon Failure

B : Reporting Device

C : Reporting IP

D : Distinct User

Answer: B,C

Question 4

When automating remediation in FortiSIEM, what should be carefully considered?

Options :

A : The potential impact of the automated action on business operations?

B : The aesthetic layout of the FortiSIEM dashboard?

C : The frequency of software updates?

D : The number of users currently logged in?

Answer: A

Question 5

What are the two SQLite databases that are used for baseline data? (Choose two.)

Options :

A : Event database

B : Daily database

C : Weekly database

D : Profile database

Answer: B,D

Higher Test Marks with Free Online FCSS_ADA_AR-6.7 Exam Practice

Buying Options: