Fortinet Fortinet Certifications NSE7_ADA-6.3 Questions & Answers

• Question 31:

  Refer to the exhibit.

  

  The rule evaluates multiple VPN logon failures within a ten-minute window. Consider the following VPN failure events received within a ten-minute window:

  

  How many incidents are generated?

  A. 1

  B. 2

  C. 0

  D. 3

  Correct Answer: B

  Explanation: The rule evaluates multiple VPN logon failures within a ten-minute window. The rule will generate an incident if there are more than three VPN logon failures from the same source IP address within a ten-minute window. Based

  on the VPN failure events received within a ten-minute window, there are two incidents generated:

  One incident for source IP address 10.10.10.10, which has four VPN logon failures at 09:01, 09:02, 09:03, and 09:04.

  One incident for source IP address 10.10.10.11, which has four VPN logon failures at 09:06, 09:07, 09:08, and 09:09.

• Question 32:

  In the event of a WAN link failure between the collector and the supervisor, by default, what is the maximum number of event files stored on the collector?

  A. 30.000

  B. 10.000

  C. 40.000

  D. 20.000

  Correct Answer: B

  Explanation: By default, the maximum number of event files stored on the collector in the event of a WAN link failure between the collector and the supervisor is 10.000. This value can be changed in the collector.properties file by modifying the parameter max_event_files_to_store. References: Fortinet NSE 7 - Advanced Analytics 6.3 escription, page 13

• Question 33:

  How do customers connect to a shared multi-tenant instance on FortiSOAR?

  A. The MSSP must provide secure network connectivity between the FortiSOAR manager node and the customer devices.

  B. The MSSP must install a Secure Message Exchange node to connect to the customer's shared multi-tenant instance.

  C. The customer must install a tenant node to connect to the MSSP shared multi-tenant instance.

  D. The MSSP must install an agent node on the customer's network to connect to the customer's shared multi-tenant instance.

  Correct Answer: D

  Explanation: To connect to a shared multi-tenant instance on FortiSOAR, the MSSP must install an agent node on the customer's network. The agent node acts as a proxy between the customer's devices and the FortiSOAR manager node. The agent node also performs data collection, enrichment, and normalization for the customer's data sources. References: Fortinet NSE 7 - Advanced Analytics 6.3 escription, page 11

• Question 34:

  Which three statements about phRuleMaster are true? (Choose three.)

  A. phRuleMaster queues up the data being received from the phRuleWorkers into buckets.

  B. phRuleMaster is present on the supervisor and workers.

  C. phRuleMaster is present on the supervisor only

  D. phRuleMaster wakes up to evaluate all the rule data in series, every 30 seconds.

  E. phRuleMaster wakes up to evaluate all the rule data in parallel, even/ 30 seconds

  Correct Answer: ABE

  Explanation: phRuleMaster is a process that performs rule evaluation and incident generation on FortiSIEM. phRuleMaster queues up the data being received from the phRuleWorkers into buckets based on time intervals, such as one minute, five minutes, or ten minutes. phRuleMaster is present on both the supervisor and workers nodes of a FortiSIEM cluster. phRuleMaster wakes up every 30 seconds to evaluate all the rule data in parallel using multiple threads.