Based on Official Syllabus Topics of Actual Fortinet NSE7_ADA-6.3 Exam [Q15-Q31]

NO.15 Refer to the exhibit.

Is the Windows agent delivering event logs correctly?

The logs are buffered by the agent and will be sent once the status changes to managed.

The agent is registered and it is sending logs correctly.

The agent is not sending logs because it did not receive a monitoring template.

Because the agent is unmanaged. the logs are dropped silently by the supervisor.

NO.16 Why can collectors not be defined before the worker upload address is set on the supervisor?

Collectors can only upload data to a worker, and the supervisor is not a worker

To ensure that the service provider has deployed at least one worker along with a supervisor

Collectors receive the worker upload address during the registration process

To ensure that the service provider has deployed a NFS server

NO.17 What is Tactic in the MITRE ATT&CK framework?

Tactic is how an attacker plans to execute the attack

Tactic is what an attacker hopes to achieve

Tactic is the tool that the attacker uses to compromise a system

Tactic is a specific implementation of the technique

NO.18 From where does the rule engine load the baseline data values?

The profile report

The daily database

The profile database

The memory

NO.19 On which disk are the SQLite databases that are used for the baselining stored?

Disk1

Disk4

Disk2

Disk3

NO.20 How can you invoke an integration policy on FortiSIEM rules?

Through Notification Policy settings

Through Incident Notification settings

Through remediation scripts

Through External Authentication settings

NO.21 What happens to UEBA events when a user is off-net?

The agent will upload the events to the Worker if it cannot upload them to a FortiSIEM collector

The agent will cache events locally if it cannot upload them to a FortiSIEM collector

The agent will upload the events to the Supervisor if it cannot upload them to a FortiSIEM collector

The agent will drop the events if it cannot upload them to a FortiSIEM collector

NO.22 Refer to the exhibit.

The window for this rule is 30 minutes.
What is this rule tracking?

A sudden 50% increase in WMI response times over a 30-minute time window

A sudden 1.50 times increase in WMI response times over a 30-minute time window

A sudden 75% increase in WMI response times over a 30-minute time window

A sudden 150% increase in WMI response times over a 30-minute time window

NO.23 Refer to the exhibit. Click on the calculator button.

The profile database contains CPU utilization values from day one. At midnight on the second day, the CPU utilization values from the daily database will be merged with the profile database.
In the profile database, in the Hour of Day column where 9 is the value, what will be the updated minimum, maximum, and average CPU utilization values?

Min CPU Util=32.31, Max CPU Ucil=33.50 and AVG CPU Util=33.50

Min CPU Util=32.31, Max CPU Ucil=33.50 and AVG CPU Util=32.67

Min CPU Util=32.31, Max CPU Ucil=32.31 and AVG CPU Util=32.31

Min CPU Util=33.50, Max CPU Ucil=33.50 and AVG CPU Util=33.50

NO.24 Which syntax will register a collector to the supervisor?

phProvisionCollector –add

NO.25 How do customers connect to a shared multi-tenant instance on FortiSOAR?

The MSSP must provide secure network connectivity between the FortiSOAR manager node and the customer devices.

The MSSP must install a Secure Message Exchange node to connect to the customer’s shared multi-tenant instance.

The customer must install a tenant node to connect to the MSSP shared multi-tenant instance.

The MSSP must install an agent node on the customer’s network to connect to the customer’s shared multi-tenant instance.

NO.26 From where does the rule engine load the baseline data values?

The profile database

The memory

The daily database

The profile report

NO.27 Refer to the exhibit.

Which statement about the rule filters events shown in the exhibit is true?

The rule filters events with an event type that belong to the Domain Account Locked CMDB group or a reporting IP that belong to the Domain Controller applications group.

The rule filters events with an event type that belong to the Domain Account Locked CMDB group and a reporting |P that belong to the Domain Controller applications group.

The rule filters events with an event type that belong to the Domain Account Locked CMDB group and a user that belongs to the Domain Controller applications group.

The rule filters events with an event type that equals Domain Account Locked and a reporting IP that equals Domain Controller applications.

NO.28 What is the disadvantage of automatic remediation?

It can make a disruptive change to a user, block access to an application, or disconnect critical systems from the network.

It is equivalent to running an IPS in monitor-only mode – watches but does not block.

External threats or attacks detected by FortiSIEM will need user interaction to take action on an already overworked SOC team.

Threat behaviors occurring during the night could take hours to respond to.

Based on Official Syllabus Topics of Actual Fortinet NSE7_ADA-6.3 Exam [Q15-Q31]

Be the first to reply

Leave a Reply Cancel reply