Online Access Free FCSS_ADA_AR-6.7 Exam Questions

Refer to the exhibit.

Why was this incident auto cleared?

• A.The original rule did not trigger within five minutes
• B.Within five minutes, the packet loss percentage dropped to a level where the host IP of the original rule matches the host IP of the clear condition pattern
• C.Within five minutes, the packet loss percentage dropped to a level where the reporting IP is same as the source IP
• D.Within five minutes the packet loss percentage dropped to a level where the reporting IP is the same as the host IP

Refer to the exhibit.

If the Z-score for this rule is greater than or equal to three, what does this mean?

• A.The rate of firewall connection is below historical average value.
• B.The rate firewall connection is above the historical average value.
• C.The rate of firewall connection is optimum.
• D.The rate of firewall connection is above the current average value.

FortiSIEM provides all rules with the ability to automatically change an active incident status to auto-cleared, based on an extra set of defined criteria.
Why would you configure FortiSIEM to automatically change an active incident status to auto-cleared?

• A.Because too many active incidents can spike the resource usaqe on FortiSIEM.
• B.Because you need a way to reduce a backlog of incident responses.
• C.Because availability or performance-related problems may trigger a threshold temporarily.
• D.Because some security-related incidents occur on a temporary basis.

Which lookup table function can be either true or false?

• A.LookupTableGet
• B.LookupTableRetriev
• C.LookupTableFilter
• D.LookupTableHas

Which statement accurately contrasts lookup tables with watchlists?

• A.You can reference lookup table data in analytic queries and reports almost immediately, whereas you may have to wait up to 5-10 minutes for watchlist entries to be useable in queries and reports.
• B.Lookup table values age out after a period, whereas watchlist values do not have any time condition.
• C.Lookup tables can contain multiple columns, whereas watchlists contain only a single column.
• D.You can populate lookup tables through an incident, whereas you cannot populate watchlists through an incident.