Online Access Free FCSS_ADA_AR-6.7 Practice Test

A service provider purchases a licensed EPS of 520. The guaranteed EPS allocated to three customers is 50, 100, and 150 respectively. At the end of every three-minute interval, incoming EPS is calculated at every collector and the value is sent to the central decision-making engine on the supervisor node.
The incoming EPS for the first collector is 25. the incoming EPS for the second collector is 50, and the incoming EPS for the third collector is 75.
Based on the information provided, what is the unused events total calculated by the supervisor?

• A.75.960
• B.76.000
• C.35.960
• D.71.460

What happens to UEBA events when a user is off-net?

• A.The agent will upload the events the events to the Supervisor if it cannot upload them to a FortiSIEM collector
• B.The agent will drop the events if it cannot upload them to a FortiSIEM collector
• C.The agent will cache events locally if it cannot upload them to a FortiSIEM collector
• D.The agent will upload the events to the Worker if it cannot upload them to a FortiSIEM collector

Which two statements about phRuleWorker are true? (Choose two.)

• A.phRuleWorker uses a 60-second bucket as an evaluation window.
• B.phRuleWorker exists on the worker only.
• C.phRuleWorker evaluates non-aggregate conditions as defined in subpattern filters of a rule in memory.
• D.phRuleWorker exists on both the supervisor and workers.

Refer to the exhibit.

The service provider deployed FortiSIEM without a collector and added three customers on the supervisor.
What mistake did the administrator make?

• A.The number of workers on the FortiSIEM cluster must match the number of customers added
• B.At least one collector must be deployed to collect logs from service provider infrastructure devices.
• C.Customer A and customer B have overlapping IP addresses.
• D.Collectors must be deployed on all customer premises before they are added to organization on the supervisor.

Refer to the exhibit.

An administrator wants to remediate the incident from FortiSIEM shown in the exhibit.
What option is available to the administrator?

• A.Run the block IP FortiOS 5.4
• B.Run the block domain Windows DNS
• C.Run the block MAC FortiOS
• D.Quarantine IP FortiClient