Fortinet NSE7_ADA-6.3 Online Practice Questions and Exam Preparation

Fortinet NSE7_ADA-6.3 Online Questions & Answers

• Question 1:

  Which three statements about collector communication with the FortiSIEM cluster are true? (Choose three.)

  A. The only communication between the collector and the supervisor is during the registration process.
  B. Collectors communicate periodically with the supervisor node.
  C. The supervisor periodically checks the health of the collector.
  D. The supervisor does not initiate any connections to the collector node.
  E. Collectors upload event data to any node in the worker upload list, but report their health directly to the supervisor node.
  B. Collectors communicate periodically with the supervisor node.
  C. The supervisor periodically checks the health of the collector.
  E. Collectors upload event data to any node in the worker upload list, but report their health directly to the supervisor node.

  ---

  Explanation/Reference:

  The statements about collector communication with the FortiSIEM cluster that are true are:

  Collectors communicate periodically with the supervisor node. Collectors send heartbeat messages to the supervisor every 30 seconds to report their status and configuration.

  The supervisor periodically checks the health of the collector. The supervisor monitors the heartbeat messages from collectors and alerts if there is any issue with their connectivity or performance.

  Collectors upload event data to any node in the worker upload list, but report their health directly to the supervisor node. Collectors use a round-robin algorithm to distribute event data among worker nodes in the worker upload list, which is

  provided by the supervisor during registration. However, collectors only report their health and status to the supervisor node.

• Question 2:

  Refer to the exhibit.

  

  An administrator deploys a new collector for the first time, and notices that all the processes except the phMonitor are down. How can the administrator bring the processes up?

  A. The administrator needs to run the command phtools --start all on the collector.
  B. Rebooting the collector will bring up the processes.
  C. The processes will come up after the collector is registered to the supervisor.
  D. The collector was not deployed properly and must be redeployed.
  C. The processes will come up after the collector is registered to the supervisor.

  ---

  Explanation/Reference:

  The collector processes are dependent on the registration with the supervisor. The phMonitor process is responsible for registering the collector to the supervisor and monitoring the health of other processes. After the registration is successful, the phMonitor will start the other processes on the collector.

• Question 3:

  Refer to the exhibit.

  

  An administrator runs an analytic search for all FortiGate SSL VPN logon failures. The results are grouped by source IP, reporting IP, and user. The administrator wants to restrict the results to only those rows where the COUNT >= 3. Which user would meet that condition?

  A. Sarah
  B. Jan
  C. Tom
  D. Admin
  C. Tom

  ---

  Explanation/Reference:

  The user who would meet that condition is Tom. Tom has four rows in the results where the COUNT is greater than or equal to three, meaning he had at least three SSL VPN logon failures from the same source IP and reporting IP. The other users have either less than three rows or less than three COUNT in each row.

• Question 4:

  In the event of a WAN link failure between the collector and the supervisor, by default, what is the maximum number of event files stored on the collector?

  A. 30.000
  B. 10.000
  C. 40.000
  D. 20.000
  B. 10.000

  ---

  Explanation/Reference:

  By default, the maximum number of event files stored on the collector in the event of a WAN link failure between the collector and the supervisor is 10.000. This value can be changed in the collector.properties file by modifying the parameter max_event_files_to_store. References: Fortinet NSE 7 - Advanced Analytics 6.3 Exam Description, page 13

• Question 5:

  Which of the following are two Tactics in the MITRE ATTandCK framework? (Choose two.)

  A. Root kit
  B. Reconnaissance
  C. Discovery
  D. BITS Jobs
  E. Phishing
  B. Reconnaissance
  C. Discovery

  ---

  Explanation/Reference:

  Reconnaissance and Discovery are two Tactics in the MITRE ATTandCK framework. Tactics are the high-level objectives of an adversary, such as initial access, persistence, lateral movement, etc. Reconnaissance is the tactic of gathering information about a target before launching an attack. Discovery is the tactic of exploring a compromised system or network to find information or assets of interest. References: Fortinet NSE 7 - Advanced Analytics 6.3 Exam Description, page 21

• Question 6:

  What happens to UEBA events when a user is off-net?

  A. The agent will upload the events to the Worker if it cannot upload them to a FortiSIEM collector
  B. The agent will cache events locally if it cannot upload them to a FortiSIEM collector
  C. The agent will upload the events to the Supervisor if it cannot upload them to a FortiSIEM collector
  D. The agent will drop the events if it cannot upload them to a FortiSIEM collector
  B. The agent will cache events locally if it cannot upload them to a FortiSIEM collector

  ---

  Explanation/Reference:

  When a user is off-net, meaning they are not connected to a network where a FortiSIEM collector is reachable, then UEBA events will be cached locally by the agent if it cannot upload them to a FortiSIEM collector. The agent will store up to 100 MB of events in a local database file and try to upload them when it detects a network change or every five minutes.

• Question 7:

  Identify the processes associated with Machine Learning/Al on FortiSIEM. (Choose two.)

  A. phFortiInsightAI
  B. phReportMaster
  C. phRuleMaster
  D. phAnomaly
  E. phRuleWorker
  A. phFortiInsightAI
  D. phAnomaly

  ---

  Explanation/Reference:

  The processes associated with Machine Learning/AI on FortiSIEM are phFortiInsightAI and phAnomaly. phFortiInsightAI is responsible for detecting anomalous user behavior using UEBA (User and Entity Behavior Analytics) techniques. phAnomaly is responsible for detecting anomalous network behavior using NTA (Network Traffic Analysis) techniques.

• Question 8:

  What are the modes of Data Ingestion on FortiSOAR? (Choose three.)

  A. Rule based
  B. Notification based
  C. App Push
  D. Policy based
  E. Schedule based
  B. Notification based
  C. App Push
  E. Schedule based

  ---

  Explanation/Reference:

  The modes of Data Ingestion on FortiSOAR are notification based, app push, and schedule based. Notification based mode allows FortiSOAR to receive data from external sources via webhooks or email notifications. App push mode allows FortiSOAR to receive data from external sources via API calls or scripts. Schedule based mode allows FortiSOAR to pull data from external sources at regular intervals using connectors. References: Fortinet NSE 7 - Advanced Analytics 6.3 Exam Description, page 17

• Question 9:

  Refer to the exhibit.

  

  How long has the UEBA agent been operationally down?

  A. 21 Hours
  B. 9 Hours
  C. 20 Hours
  D. 2 Hours
  A. 21 Hours

  ---

  Explanation/Reference:

  The UEBA agent status shows that it has been operationally down for one day and three hours ago (1d3h). This means that it has been down for 24 hours plus three hours, which is equal to 21 hours.

• Question 10:

  Why can collectors not be defined before the worker upload address is set on the supervisor?

  A. Collectors can only upload data to a worker, and the supervisor is not a worker
  B. To ensure that the service provider has deployed at least one worker along with a supervisor
  C. Collectors receive the worker upload address during the registration process
  D. To ensure that the service provider has deployed a NFS server
  C. Collectors receive the worker upload address during the registration process

  ---

  Explanation/Reference:

  Collectors cannot be defined before the worker upload address is set on the supervisor because collectors receive the worker upload address during the registration process. The worker upload address is a list of IP addresses of worker nodes that can receive event data from collectors. The supervisor provides this list to collectors when they register with it, so that collectors can upload event data to any node in the list.