FCSS_ADA_AR-6-7 Practice Questions

A When a User and Entity Behavior Analytics (UEBA) agent is off-net, meaning it is disconnected from the network and cannot reach the FortiSIEM collector, it temporarily stores (caches) events locally until it can re-establish a connection. ● This caching mechanism prevents data loss by ensuring events are retained even when the agent is offline. ● Once the connection to the FortiSIEM collector is restored, the agent uploads the cached events. ● This ensures continuity in user behavior monitoring, even when users are disconnected.

D FortiSIEM's rule engine queries the profile database to analyze historical behavior and detect anomalies. The profile database stores statistical baselines, which include: ● Statistical average (mean values over time) ● Standard deviation (variability from the mean) These values help the rule engine determine whether an observed metric (such as logins, failed attempts, network traffic, or system performance) deviates significantly from the normal pattern for the same hour of the day.

B In the exhibit, the "Clear If" condition does not specify a condition for auto-clearing the incident. If an incident does not have a specific clear condition, it remains active until manually resolved or cleared by another process.

C FortiSIEM's User and Entity Behavior Analytics (UEBA) uses AI-driven modeling to detect anomalies and security risks based on user activity. The risk weighting for UEBA tags allows customization of the AI model by prioritizing certain behaviors or indicators over others. Adjusting risk weightings fine-tunes how the AI model evaluates risk, helping organizations align detection sensitivity with their security policies. This provides a customized risk scoring mechanism without requiring full AI retraining.

A, B, E FortiSIEM collectors are responsible for gathering logs from devices and forwarding them to the FortiSIEM cluster. Their communication with the cluster follows these key principles: ● Collectors periodically communicate with the supervisor node. ● This allows them to report status, receive updates, and verify configurations. ● The supervisor periodically checks the health of the collector. ● The supervisor monitors the collector’s uptime, connectivity, and performance. ● Collectors upload event data to worker nodes but report health to the supervisor. ● Event logs are uploaded to worker nodes as per the worker upload list, ensuring distributed event processing. ● Health status is always reported directly to the supervisor for centralized monitoring.

A From the exhibit, the rule exception is set for: ● Time Range: Starts at 00:00:00 ● Duration: 2 days ● Recurrence Pattern: December 25th and December 26th This means that during these two days (every year in December), the rule will not trigger incidents. Rule exceptions temporarily suppress incident generation during the specified period. Events are still processed, but no incidents are generated.

D FortiSIEM does not allow CMDB queries to be nested within other CMDB queries. CMDB data is static information, and nesting would not add value or function properly in query execution.

A At midnight, the daily database values merge into the profile database. The new values for Hour 9 are calculated as follows: ● Minimum CPU Utilization: The new minimum is the lower of the existing (32.31) and new (33.50) values → 32.31 ● Maximum CPU Utilization: The new maximum is the higher of the existing (32.31) and new (33.50) values → 33.50 ● Average CPU Utilization: ● The previous average was 32.31 (from one point). ● The new value from the daily database is 33.50 (one additional point). ● The new average is calculated as: Thus, after merging, the updated profile database values for Hour 9 are: ● Min CPU Util = 32.31 ● Max CPU Util = 33.50 ● Avg CPU Util = 32.67

B, C From the provided XML configuration, we need to focus on the section, which defines the attributes used for grouping. In the SelectClause, the following attributes are listed: reptDevName, reptDevAddr, COUNT(*), COUNT(DISTINCT user), COUNT(DISTINCT srcIpAddr) ● reptDevName represents the reporting device. ● reptDevAddr represents the reporting IP. ● COUNT(DISTINCT user) tracks unique users. ● COUNT(DISTINCT srcIpAddr) tracks distinct source IPs. In the GroupByAttr section: reptDevName, reptDevAddr This confirms that the grouping is performed by Reporting Device (reptDevName) and Reporting IP (reptDevAddr).

A, D FortiSIEM enforces a device limit based on licensing and system-wide constraints to ensure proper resource allocation and performance management. The device limit is determined by the purchased license. ● FortiSIEM licensing includes limits on the number of devices that can be monitored. ● The license type (e.g., Enterprise vs. Service Provider) defines the maximum number of devices supported. For Service Provider editions, the device limit applies system-wide and is shared across all customers. ● In an MSSP (Managed Security Service Provider) setup, the total device limit applies across all customers, rather than being allocated individually. ● This allows flexible resource allocation based on customer needs.