Question 1

Refer to the exhibit.

Why was this incident auto cleared?

Options :

A :

Within five minutes, the packet loss percentage dropped to a level where the host IP of the original rule matches the host IP of the clear condition pattern

B :

Within five minutes the packet loss percentage dropped to a level where the reporting IP is the same as the host IP

C : The original rule did not trigger within five minutes

D :

Within five minutes, the packet loss percentage dropped to a level where the reporting IP is same as the source IP

Answer: A

Question 2

Which statement accurately contrasts lookup tables with watchlists?

Options :

A : Lookup table values age out after a period, whereas watchlist values do not have any time condition.

B : You can populate lookup tables through an incident, whereas you cannot populate watchlists through an incident.

C : Lookup tables can contain multiple columns, whereas watchlists contain only a single column.

D :

You can reference lookup table data in analytic queries and reports almost immediately, whereas you may have to wait up to 5-10 minutes for watchlist entries to be useable in queries and reports.

Answer: C

Question 3

Refer to the exhibit.

Consider a nested event query where both inner and outer queries are event queries. Reporting IP is selected from the CMDB group Network Device, Event Type is selected from the CMDB group Logon Success, and Source IP is selected from the report Failed Logons to Network Devices. An administrator is about to execute the nested query. The report time ranges must be set before execution. The Nested Time Range will be applied to which attributes?

Options :

A : The nested time range will be configured for the Reporting IP attribute.

B : The nested time range will be configured for the Reporting IP and Event Type attributes.

C : The nested time range will be configured for the Source IP attribute.

D : The nested time range will be configured for the Event Type attribute.

Answer: C

Question 4

Refer to the exhibit.

An administrator wants to remediate the incident from FortiSIEM shown in the exhibit. What option is available to the administrator?

Options :

A : Quarantine IP FortiClient

B : Run the block domain Windows DNS

C : Run the block MAC FortiOS

D : Run the block IP FortiOS 5.4

Answer: D

Question 5

What happens to UEBA events when a user is off-net?

Options :

A : The agent will upload the events to the Worker if it cannot upload them to a FortiSIEM collector

B : The agent will upload the events to the Supervisor if it cannot upload them to a FortiSIEM collector

C : The agent will cache events locally if it cannot upload them to a FortiSIEM collector

D : The agent will drop the events if it cannot upload them to a FortiSIEM collector

Answer: C

Higher Test Marks with Free Online FCSS_ADA_AR-6.7 Exam Practice

Buying Options: