Latest FCSS_ADA_AR-6.7 exam dumps with real Fortinet questions and answers [Q28-Q50]

Rate this post

Latest FCSS_ADA_AR-6.7 exam dumps with real Fortinet questions and answers

FCSS_ADA_AR-6.7 Exam in First Attempt Guaranteed

Q28. Which of the following are two Tactics in the MITRE ATT&CK framework? (Choose two.)

Rootkit

Reconnaissance

Discovery

BITS Jobs

Phishing

Q29. In the context of FortiSIEM, agents are primarily tasked to:

Act as a firewall and protect endpoints.

Provide backup and restore capabilities.

Forward logs and events to the FortiSIEM solution.

Ensure smooth communication between different tenants.

Q30. Which two statements about phRuleWorker are true? (Choose two.)

phRuleWorker uses a 60-second bucket as an evaluation window.

phRuleWorker evaluates non-aggregate conditions as defined in subpattern filters of a rule in memory.

phRuleWorker exists on both the supervisor and workers.

phRuleWorker exists on the worker only.

phRuleWorker processes events in 60-second intervals (buckets). This means that events within a one-minute window are evaluated together for rule conditions, helping detect patterns, correlations, and triggers.
phRuleWorker runs both on the supervisor and worker nodes to distribute event processing. The supervisor primarily orchestrates rule evaluation, while workers handle distributed event processing.

Q31. Which function of Linux is used by FortiSIEM for collecting logs?

aureport

ausearch

autrace

auditd

Q32. Refer to the exhibit.

How long has the UEBA agent been operationally down?

2 Hours

20 Hours

21 Hours

9 Hours

Based on the provided exhibit, we can determine how long the UEBA agent has been operationally down by looking at the “First Occurred” and “Last Occurred” timestamps.
# First Occurred: Sep 13, 2021, at 01:10 PM
# Last Occurred: Sep 14, 2021, at 09:10 AM
From Sep 13, 01:10 PM to Sep 14, 01:10 AM # 12 hours
From Sep 14, 01:10 AM to Sep 14, 09:10 AM # 8 hours
Total downtime = 12 + 8 = 20 hours

Q33. Where are the SQLite databases that are used for the baselining, stored?

/opt/phoenix/cache

/opt/phoenix/bin

/opt/phoenix/config

/opt/phoenix/delta

InFortiSIEM,SQLite databasesused forbaseliningare stored in the/opt/phoenix/cachedirectory. This location is used fortemporary storage and caching of profile datathat is essential for anomaly detection and trend analysis.
#Baselininginvolves analyzing historical data to determine expected behavior patterns.
#SQLite databasesstore aggregated statistics, which are referenced during rule evaluations.
# Thecache directoryallows quick access to these values without querying the main database repeatedly.

Q34. Refer to the exhibit.

Consider a nested event query where both inner and outer queries are event queries.
Reporting IPis selected from the CMDB groupNetwork Device, Event Typeis selected from the CMDB groupLogon Success,andSource IPis selected from the reportFailed Logons to Network Devices.
An administrator is about to execute the nested query. The report time ranges must be set before execution.
TheNested Time Rangewill be applied to which attributes?

The nested time range will be configured for the Reporting IP attribute.

The nested time range will be configured for the Reporting IP and Event Type attributes.

The nested time range will be configured for the Source IP attribute.

The nested time range will be configured for the Event Type attribute.

In a nested event query, the inner query executes first, and its results feed into the outer query. Since the Source IP comes from the report “Failed Logons to Network Devices”, which is part of the inner query, the nested time range applies to it. The other attributes, Reporting IP and Event Type, belong to the outer query and are not affected by the nested time range.

Q35. Refer to the exhibit.

The service provider deployed FortiSIEM without a collector and added three customers on the supervisor.
What mistake did the administrator make?

Customer A and customer B have overlapping IP addresses.

Collectors must be deployed on all customer premises before they are added to organizations on the supervisor.

The number of workers on the FortiSIEM cluster must match the number of customers added.

At least one collector must be deployed to collect logs from service provider infrastructure devices.

Q36. Which lookup table function can be either true or false?

LookupTableHas

LookupTableGet

LookupTableFilter

LookupTableRetriev

TheLookupTableHasfunction is used tocheck whether a specified key exists in a lookup table. It returnseither true or false, depending on whether the key is found in the table.
# If the key is present, the function returnstrue.
# If the key is absent, the function returnsfalse.

Q37. Refer to the exhibit.

Which workers are assigned tasks for the query ID13127? (Choose two.)

Worker1 has no tasks for query ID 13127*.

Worker1 has one task for query ID 13127*.

Worker2 has two tasks for query ID 13127*.

Worker3 has four tasks for query ID 13127*.

Worker3 has two tasks for query ID 13127*.

The exhibit shows the directory listings forthree different workers(worker1,worker2, andworker3) under the
/querywkr/active/13127*path, which indicatesactive query tasksassigned to each worker.
1.Worker1 (worker1)
The output doesnotshow any subdirectories or task files (13127t0,13127t1, etc.), meaningWorker1 is not assigned any tasks.*
2.Worker2 (worker2)
The output showsone task (13127t1)under/querywkr/active/13127*.
The workerhas only one assigned task, not two, so optionsC and D are incorrect.
3.Worker3 (worker3)
The output showstwo tasks (13127t0and13127t1), indicating that Worker3 is processingtwo tasksfor query ID
13127.*

Q38. How can you empower SOC by deploying FortiSOAR? (Choose three.)

Aggregate logs from distributed systems

Collaborative knowledge sharing

Baseline user and traffic behavior

Reduce human error

Address analyst skills gap

Q39. Refer to the exhibit.

Why is the windows device still in the CMDB, even though the administrator uninstalled the windows agent?

The device mustbe deleted from backend of FortiSIEM

The device has performance jobs assigned

The device was not installed properly

The device must be deleted manually from the CMDB

InFortiSIEM, when an agent isuninstalled from a Windows device, the deviceremains in the CMDB (Configuration Management Database)until it ismanually removed.
#Uninstalling the agent does not automatically remove the device from the CMDB.
# CMDB maintains discovered deviceseven if they no longer report logs, ensuring historical tracking.
# Administrators mustmanually deletethe device from theCMDB > Devicessection.

Q40. How can you empower SOC by deploying FortiSOAR? (Choose three.)

Collaborative knowledge sharing

Aggregate logs from distributed systems

Address analyst skills gap

Baseline user and traffic behavior

Reduce human error

Collaborative knowledge sharing: FortiSOAR enables security teams to share knowledge, automate workflows, and improve incident response efficiency by centralizing intelligence and standardizing processes.
Addressing analyst skills gap: By automating repetitive tasks and providing guided response playbooks, FortiSOAR helps SOC teams compensate for skill shortages and improve operational effectiveness.
Reducing human error: Automation and predefined workflows minimize manual interventions, reducing the likelihood of errors in incident detection, response, and remediation.

Q41. Refer to the exhibit.

An administrator wants to remediate the incident from FortiSIEM shown in the exhibit.
What option is available to the administrator?

Quarantine IP FortiClient

Run the block MAC FortiOS.

Run the block IP FortiOS 5.4

Run the block domain Windows DNS

Q42. What happens to events that the collector receives when there is a WAN link failure between the collector and the supervisor?

Events are buffered for up to 24 hours.

Events are buffered up to 10 MB before compression.

Events are buffered up to 10.000 logs.

Events are buffered up to 1 GB after compression.

When a WAN link failure occurs between the collector and the supervisor in FortiSIEM:
# The collector does not discard events; instead, it buffers them until the connection is restored.
# The buffering limit is up to 1 GB after compression to optimize storage and prevent data loss.
# Once the WAN link is restored, buffered events are sent to the supervisor for processing.

Q43. Which three statements about phRuleMaster are true? (Choose three.)

phRuleMaster queues up the data being received from the phRuleWorkers into buckets.

phRuleMaster is present on the supervisor and workers.

phRuleMaster is present on the supervisor only

phRuleMaster wakes up to evaluate all the rule data in series, every 30 seconds.

phRuleMaster wakes up to evaluate all the rule data in parallel, even/ 30 seconds

Q44. Refer to the exhibit.

What is the collector ID?

2000

50000

10000

Q45. FortiSOAR is primarily used for:

Storing large amounts of data?

Streamlining administrative tasks like adding new users?

Automating response actions to security incidents?

Designing network topologies?

Q46. Refer to the exhibit.

The window for this rule is 30 minutes.
What is this rule tracking?

A sudden 50% increase in WMI response times over a 30-minute time window

A sudden 1.50 times increase in WMI response times over a 30-minute time window

A sudden 75% increase in WMI response times over a 30-minute time window

A sudden 150% increase in WMI response times over a 30-minute time window

Q47. Which two statements are true regarding template creation? (Choose two.)

Templates must be created on the individual customer scope.

You must be logged into the super global scope with an admin level account to create templates.

Template name can contain spaces.

You can create one or more templates and use it across multiple customers.

Q48. Which syntax will register a collector to the supervisor?

phProvisionCollector -add <user><password><super ID><organization><collectorName>

phProvisionCollector -add <user><password><collector IP><organizationid><collectorName>

phProvisionCollector -add <user><password><super IP><organization><workerName>

phProvisionCollector -add <user><password><collector IP><organization><superName>

The phProvisionCollector command is used to register a collector to the supervisor in FortiSIEM. The correct syntax requires:
# User # The admin username for authentication.
# Password # The password for authentication.
# Super IP # The IP address of the supervisor, which manages the collector.
# Organization # The organization to which the collector belongs.
# Worker Name # The name of the worker node responsible for handling events from this collector.

Q49. When automating remediation in FortiSIEM, what should be carefully considered?

The potential impact of the automated action on business operations?

The aesthetic layout of the FortiSIEM dashboard?

The frequency of software updates?

The number of users currently logged in?

Q50. Refer to the exhibit.

The rule evaluates multiple VPN logon failures within a ten-minute window.
Consider the following VPN failure events received within a ten-minute window:

How many incidents are generated?