Download Fortinet.NSE7_ADA-6.3.VCEplus.2023-12-06.18q.tqb
| Vendor: | Fortinet |
| Exam Code: | NSE7_ADA-6.3 |
| Exam Name: | Fortinet NSE 7 -Advanced Analytics 6-3 |
| Date: | Dec 06, 2023 |
| File Size: | 2 MB |
| Downloads: | 1 |
Demo Questions
Question 1
Which two statements about the maximum device limit on FortiSIEM are true? (Choose two.)
- The device limit is defined per customer and every customer is assigned a fixed number of device limit by the service provider.
- The device limit is only applicable to enterprise edition.
- The device limit is based on the license type that was purchased from Fortinet.
- The device limit is defined for the whole system and is shared by every customer on a service provider edition.
Correct answer: BC
Explanation:
The device limit is a feature of the enterprise edition of FortiSIEM that restricts the number of devices that can be added to the system based on the license type. The device limit does not apply to the service provider edition, which allows unlimited devices per customer. The device limit is determined by the license type that was purchased from Fortinet, such as 100 devices, 500 devices, or unlimited devices. The device limit is a feature of the enterprise edition of FortiSIEM that restricts the number of devices that can be added to the system based on the license type. The device limit does not apply to the service provider edition, which allows unlimited devices per customer. The device limit is determined by the license type that was purchased from Fortinet, such as 100 devices, 500 devices, or unlimited devices.
Question 2
Refer to the exhibit.
Which statement about the rule filters events shown in the exhibit is true?
- The rule filters events with an event type that belong to the Domain Account Locked CMDB group or a reporting IP that belong to the Domain Controller applications group.
- The rule filters events with an event type that belong to the Domain Account Locked CMDB group and a reporting |P that belong to the Domain Controller applications group.
- The rule filters events with an event type that belong to the Domain Account Locked CMDB group and a user that belongs to the Domain Controller applications group.
- The rule filters events with an event type that equals Domain Account Locked and a reporting IP that equals Domain Controller applications.
Correct answer: B
Explanation:
The rule filters events with an event type that belong to the Domain Account Locked CMDB group and a reporting IP that belong to the Domain Controller applications group. This means that only events that have both criteria met will be processed by this rule. The event type and reporting IP are joined by an AND operator, which requires both conditions to be true. The rule filters events with an event type that belong to the Domain Account Locked CMDB group and a reporting IP that belong to the Domain Controller applications group. This means that only events that have both criteria met will be processed by this rule. The event type and reporting IP are joined by an AND operator, which requires both conditions to be true.
Question 3
Refer to the exhibit.
Why is the windows device still in the CMDB, even though the administrator uninstalled the windows agent?
- The device was not uninstalled properly
- The device must be deleted from backend of FortiSIEM
- The device has performance jobs assigned
- The device must be deleted manually from the CMDB
Correct answer: D
Explanation:
The windows device is still in the CMDB, even though the administrator uninstalled the windows agent, because the device must be deleted manually from the CMDB. Uninstalling the windows agent does not automatically remove the device from the CMDB, as there may be other sources of data for the device, such as SNMP or syslog. To delete the device from the CMDB, the administrator must go to CMDB > Devices > All Devices, select the device, and click Delete. The windows device is still in the CMDB, even though the administrator uninstalled the windows agent, because the device must be deleted manually from the CMDB. Uninstalling the windows agent does not automatically remove the device from the CMDB, as there may be other sources of data for the device, such as SNMP or syslog. To delete the device from the CMDB, the administrator must go to CMDB > Devices > All Devices, select the device, and click Delete.
