Online Access Free FCSS_ADA_AR-6.7 Exam Questions

Why do collectors communicate with the Supervisor after registration? (Choose two.)

• A.To receive templates associated with agents
• B.To upload event data if a worker down
• C.To report the health status of the agents
• D.To report its own health status

What is the hourly bucket used in baselining?

• A.To store data for specific baselines during the weekend, if there is a spike in network activity
• B.To store data for specific baselines during peak business hours of weekdays
• C.To store hourly baselines reports for every hour of the day during weekdays and weekends
• D.To store data for specific baselines for every hour of the day during weekdays and weekends

Refer to the exhibit.

Consider the five account locked events received by FortiSIEM from domain controllers within the last 10 minutes (ten minutes is the evaluation window for the subpattern DomainAcctLockout):

If you look for one or more matching events and groupings by the same reporting IP address, reporting device, and user, how many incidents are created?

• A.1
• B.4
• C.2
• D.3

Which three statements about phRuleMaster are true? (Choose three.)

• A.phRuleMaster is present on the supervisor only.
• B.phRuleMaster wakes up to evaluate all the rule data in parallel, every 30 seconds.
• C.phRuleMaster wakes up to evaluate all the rule data in series, every 30 seconds.
• D.phRuleMaster is present on the supervisor and workers.
• E.phRuleMaster queues up the data being received from the phRuleWorkers into buckets.

Refer to the exhibit.

If the Z-score for this rule is greater than or equal to three, what does this mean?

• A.The rate of firewall connection is below historical average value.
• B.The rate of firewall connection is above the current average value.
• C.The rate firewall connection is above the historical average value.
• D.The rate of firewall connection is optimum.