NSE7_ADA-6.3 Online Practice Questions and Answers
Which two statements about the maximum device limit on FortiSIEM are true? (Choose two.)
A. The device limit is defined per customer and every customer is assigned a fixed number of device limit by the service provider.
B. The device limit is only applicable to enterprise edition.
C. The device limit is based on the license type that was purchased from Fortinet.
D. The device limit is defined for the whole system and is shared by every customer on a service provider edition.
Which three statements about collector communication with the FortiSIEM cluster are true? (Choose three.)
A. The only communication between the collector and the supervisor is during the registration process.
B. Collectors communicate periodically with the supervisor node.
C. The supervisor periodically checks the health of the collector.
D. The supervisor does not initiate any connections to the collector node.
E. Collectors upload event data to any node in the worker upload list, but report their health directly to the supervisor node.
On which disk are the SQLite databases that are used for the baselining stored?
A. Disk1
B. Disk4
C. Disk2
D. Disk3
Refer to the exhibit.
An administrator deploys a new collector for the first time, and notices that all the processes except the phMonitor are down. How can the administrator bring the processes up?
A. The administrator needs to run the command phtools --start all on the collector.
B. Rebooting the collector will bring up the processes.
C. The processes will come up after the collector is registered to the supervisor.
D. The collector was not deployed properly and must be redeployed.
Which syntax will register a collector to the supervisor?
A. phProvisionCollector --add
B. phProvisionCollector --add
C. phProvisionCollector --add
D. phProvisionCollector --add
Refer to the exhibit.
The service provider deployed FortiSIEM without a collector and added three customers on the supervisor. What mistake did the administrator make?
A. Customer A and customer B have overlapping IP addresses.
B. Collectors must be deployed on all customer premises before they are added to organizations on the supervisor.
C. The number of workers on the FortiSIEM cluster must match the number of customers added.
D. At least one collector must be deployed to collect logs from service provider infrastructure devices.
What is Tactic in the MITRE ATTandCK framework?
A. Tactic is how an attacker plans to execute the attack
B. Tactic is what an attacker hopes to achieve
C. Tactic is the tool that the attacker uses to compromise a system
D. Tactic is a specific implementation of the technique
How can you empower SOC by deploying FortiSOAR? (Choose three.)
A. Aggregate logs from distributed systems
B. Collaborative knowledge sharing
C. Baseline user and traffic behavior
D. Reduce human error
E. Address analyst skills gap
Refer to the exhibit.
Which statement about the rule filters events shown in the exhibit is true?
A. The rule filters events with an event type that belong to the Domain Account Locked CMDB group or a reporting IP that belong to the Domain Controller applications group.
B. The rule filters events with an event type that belong to the Domain Account Locked CMDB group and a reporting |P that belong to the Domain Controller applications group.
C. The rule filters events with an event type that belong to the Domain Account Locked CMDB group and a user that belongs to the Domain Controller applications group.
D. The rule filters events with an event type that equals Domain Account Locked and a reporting IP that equals Domain Controller applications.
Refer to the exhibit.
An administrator runs an analytic search for all FortiGate SSL VPN logon failures. The results are grouped by source IP, reporting IP, and user. The administrator wants to restrict the results to only those rows where the COUNT >= 3. Which user would meet that condition?
A. Sarah
B. Jan
C. Tom
D. Admin