Exit demo NSE7_ADA-6.3 Fortinet NSE 7 - Advanced Analytics 6.3 PDF format · free preview

Fortinet NSE7_ADA-6.3 - Questions & Answers

Free preview · every answer includes a full explanation

Product page: https://prepkeys.com/nse7-ada-63.html

Question 1
Multiple choice

Which two statements about the maximum device limit on FortiSIEM are true? (Choose two.)

A.

The device limit is defined per customer and every customer is assigned a fixed number of device limit by the service provider.

B.

The device limit is only applicable to enterprise edition.

C.

The device limit is based on the license type that was purchased from Fortinet.

D.

The device limit is defined for the whole system and is shared by every customer on a service provider edition.

Question 2
Single choice

Refer to the exhibit.

Why was this incident auto cleared?

A.

Within five minutes the packet loss percentage dropped to a level where the reporting IP is the same as the host IP

B.

The original rule did not trigger within five minutes

C.

Within five minutes, the packet loss percentage dropped to a level where the reporting IP is same as the source IP

D.

Within five minutes, the packet loss percentage dropped to a level where the host IP of the original rule matches the host IP of the clear condition pattern

Question 3
Multiple choice

Which three statements about collector communication with the FortiSIEM cluster are true? (Choose three.)

A.

The only communication between the collector and the supervisor is during the registration process.

B.

Collectors communicate periodically with the supervisor node.

C.

The supervisor periodically checks the health of the collector.

D.

The supervisor does not initiate any connections to the collector node.

E.

Collectors upload event data to any node in the worker upload list, but report their health directly to the supervisor node.

Question 4
Single choice

On which disk are the SQLite databases that are used for the baselining stored?

A.

Disk1

B.

Disk4

C.

Disk2

D.

Disk3

Question 5
Single choice

Refer to the exhibit.

An administrator deploys a new collector for the first time, and notices that all the processes except the phMonitor are down.

How can the administrator bring the processes up?

A.

The administrator needs to run the command phtools --start all on the collector.

B.

Rebooting the collector will bring up the processes.

C.

The processes will come up after the collector is registered to the supervisor.

D.

The collector was not deployed properly and must be redeployed.

Question 6
Single choice

What happens to UEBA events when a user is off-net?

A.

The agent will upload the events to the Worker if it cannot upload them to a FortiSIEM collector

B.

The agent will cache events locally if it cannot upload them to a FortiSIEM collector

C.

The agent will upload the events to the Supervisor if it cannot upload them to a FortiSIEM collector

D.

The agent will drop the events if it cannot upload them to a FortiSIEM collector

Question 7
Single choice

Why can collectors not be defined before the worker upload address is set on the supervisor?

A.

Collectors can only upload data to a worker, and the supervisor is not a worker

B.

To ensure that the service provider has deployed at least one worker along with a supervisor

C.

Collectors receive the worker upload address during the registration process

D.

To ensure that the service provider has deployed a NFS server

Question 8
Single choice

Refer to the exhibit.

If the Z-score for this rule is greater than or equal to three, what does this mean?

A.

The rate of firewall connection is optimum.

B.

The rate of firewall connection is above the historical average value.

C.

The rate of firewall connection is above the current average value.

D.

The rate of firewall connection is below historical average value.

Question 9
Single choice

Refer to the exhibit. Click on the calculator button.

Based on the information provided in the exhibit, calculate the unused events for the next three minutes for a 520 EPS license.

A.

72460

B.

73460

C.

74460

D.

71460

Question 10
Single choice

Refer to the exhibit.

The exhibit shows the output of an SQL command that an administrator ran to view the natural_id value, after logging into the Postgres database.

What does the natural_id value identify?

A.

The supervisor

B.

The worker

C.

An agent

D.

The collector

Showing 10 of 34 questions · Unlock the full set