VCEdump

NSE7_ADA-6.3 Fortinet NSE 7 - Advanced Analytics 6.3

PDF question preview Back to product

Free preview

6 sample questions

The complete product contains 34 questions.

Question formats

Single choice3

Multiple choice3

Compare study plans

Fortinet · NSE7_ADA-6.3

NSE7_ADA-6.3 questions and answers

Review the question wording, option layout, and available explanations before choosing a study plan.

Question 1

Single choice

Refer to the exhibit. Click on the calculator button.

The profile database contains CPU utilization values from day one. At midnight on the second day, the CPU utilization values from the daily database will be merged with the profile database.

In the profile database, in the Hour of Day column where 9 is the value, what will be the updated minimum, maximum, and average CPU utilization values?

A
Min CPU Util=32.31, Max CPU Ucil=33.50 and AVG CPU Util=33.50
B
Min CPU Util=32.31, Max CPU Ucil=33.50 and AVG CPU Util=32.67
C
Min CPU Util=32.31, Max CPU Ucil=32.31 and AVG CPU Util=32.31
D
Min CPU Util=33.50, Max CPU Ucil=33.50 and AVG CPU Util=33.50

Reveal answer details Close answer details

Correct answerB

Explanation

Explanation: The profile database contains CPU utilization values from day one. At midnight on the second day, the CPU utilization values from the daily database will be merged with the profile database using a weighted average formula:
New value = (Old value x Old weight) + (New value x New weight) / (Old weight + New weight)
The weight is determined by the number of days in each database. In this case, the profile database has one day of data and the daily database has one day of data, so the weight is equal for both databases.
Therefore, the formula simplifies to:
New value = (Old value + New value) / 2
In the profile database, in the Hour of Day column where 9 is the value, the updated minimum, maximum, and average CPU utilization values are:
Min CPU Util = (32.31 + 32.31) / 2 = 32.31 Max CPU Util = (33.50 + 33.50) / 2 = 33.50 AVG CPU Util =
(32.67 + 32.67) / 2 = 32.67

Question 2

Single choice

Which statement about EPS bursting is true?

A
FortiSIEM will let you burst up to five times the licensed EPS once during a 24-hour period.
B
FortiSIEM must be provisioned with ten percent the licensed EPS to handle potential event surges.
C
FortiSIEM will let you burst up to five times the licensed EPS at any given time, provided it has
accumulated enough unused EPS.
D
FortiSIEM will let you burst up to five times the licensed EPS at any given time, regardless of unused of
EPS.

Reveal answer details Close answer details

Correct answerC

Explanation

Explanation: FortiSIEM allows EPS bursting to handle event spikes without dropping events or violating the license agreement. EPS bursting means that FortiSIEM will let you burst up to five times the licensed EPS at any given time, provided it has accumulated enough unused EPS from previous time intervals.

Question 3

Multiple choice

Which three statements about collector communication with the FortiSIEM cluster are true? (Choose three.)

A
The only communication between the collector and the supervisor is during the registration process.
B
Collectors communicate periodically with the supervisor node.
C
The supervisor periodically checks the health of the collector.
D
The supervisor does not initiate any connections to the collector node.
E
Collectors upload event data to any node in the worker upload list, but report their health directly to the supervisor node.

Reveal answer details Close answer details

Correct answersB, C, E

Explanation

Explanation: The statements about collector communication with the FortiSIEM cluster that are true are:
Collectors communicate periodically with the supervisor node. Collectors send heartbeat messages to the supervisor every 30 seconds to report their status and configuration.
The supervisor periodically checks the health of the collector. The supervisor monitors the heartbeat messages from collectors and alerts if there is any issue with their connectivity or performance.
Collectors upload event data to any node in the worker upload list, but report their health directly to the supervisor node. Collectors use a round-robin algorithm to distribute event data among worker nodes in the worker upload list, which is provided by the supervisor during registration. However, collectors only report their health and status to the supervisor node.

Question 4

Single choice

Refer to the exhibit.

Is the Windows agent delivering event logs correctly?

A
The logs are buffered by the agent and will be sent once the status changes to managed.
B
The agent is registered and it is sending logs correctly.
C
The agent is not sending logs because it did not receive a monitoring template.
D
Because the agent is unmanaged. the logs are dropped silently by the supervisor.

Reveal answer details Close answer details

Correct answerD

Explanation

Explanation: The windows agent is not delivering event logs correctly because the agent is unmanaged, meaning it is not assigned to any organization or customer. The supervisor will drop the logs silently from unmanaged agents, as they are not associated with any valid license or CMDB.

Question 5

Multiple choice

Identify the processes associated with Machine Learning/Al on FortiSIEM. (Choose two.)

A
phFortiInsightAI
B
phReportMaster
C
phRuleMaster
D
phAnomaly
E
phRuleWorker

Reveal answer details Close answer details

Correct answersA, D

Explanation

Explanation: The processes associated with Machine Learning/AI on FortiSIEM are phFortiInsightAI and phAnomaly. phFortiInsightAI is responsible for detecting anomalous user behavior using UEBA (User and Entity Behavior Analytics) techniques. phAnomaly is responsible for detecting anomalous network behavior
using NTA (Network Traffic Analysis) techniques.

Question 6

Multiple choice

Which three statements about phRuleMaster are true? (Choose three.)

A
phRuleMaster queues up the data being received from the phRuleWorkers into buckets.
B
phRuleMaster is present on the supervisor and workers.
C
phRuleMaster is present on the supervisor only
D
phRuleMaster wakes up to evaluate all the rule data in series, every 30 seconds.
E
phRuleMaster wakes up to evaluate all the rule data in parallel, even/ 30 seconds

Reveal answer details Close answer details

Correct answersA, B, E

Explanation

Explanation: phRuleMaster is a process that performs rule evaluation and incident generation on FortiSIEM. phRuleMaster queues up the data being received from the phRuleWorkers into buckets based on time intervals, such as one minute, five minutes, or ten minutes. phRuleMaster is present on both the supervisor and workers nodes of a FortiSIEM cluster. phRuleMaster wakes up every 30 seconds to evaluate all the rule data in parallel using multiple threads.