Fortinet FCSS_ADA_AR-6.7 Quiz 1 Topic 4 Questions 1-5

Question: 1

Refer to the exhibit.

q1_FCSS_ADA_AR-6.7

Which devices will be added to the CMDB and mapped to Customer E?

A10.50.0.150

B10.50.0.1

C10.60.0.1

D10.50.0.149
From the exhibit, we can determine the IP range that will be added to the CMDB and mapped to Customer E.
The included IP range is 10.50.0.1 -- 10.50.0.50.
This means any device within this range (10.50.0.1 to 10.50.0.50) will be added to the CMDB.
10.50.0.1 Falls within the included range (10.50.0.1 -- 10.50.0.50) Added to CMDB.
10.50.0.149 Falls within the 10.50.0.1 -- 10.50.0.50 range Added to CMDB.

Show Answer

Question: 2

How can you empower SOC by deploying FortiSOAR? (Choose three.)

ACollaborative knowledge sharing

BAggregate logs from distributed systems

CAddress analyst skills gap

DBaseline user and traffic behavior

EReduce human error
Collaborative knowledge sharing: FortiSOAR enables security teams to share knowledge, automate workflows, and improve incident response efficiency by centralizing intelligence and standardizing processes.
Addressing analyst skills gap: By automating repetitive tasks and providing guided response playbooks, FortiSOAR helps SOC teams compensate for skill shortages and improve operational effectiveness.
Reducing human error: Automation and predefined workflows minimize manual interventions, reducing the likelihood of errors in incident detection, response, and remediation.

Show Answer

Question: 3

Refer to the exhibit.

q3_FCSS_ADA_AR-6.7

The service provider deployed FortiSIEM without a collector and added three customers on the supervisor.

What mistake did the administrator make?

AThe number of workers on the FortiSIEM cluster must match the number of customers added

BCollectors must be deployed on all customer premises before they are added to organization on the supervisor.

CAt least one collector must be deployed to collect logs from service provider infrastructure devices.

DCustomer A and customer B have overlapping IP addresses.
The administrator deployed FortiSIEM without a collector, meaning there is no dedicated system collecting logs from service provider infrastructure devices. Without a collector, the FortiSIEM supervisor and workers must directly ingest logs, which is not ideal for a multi-tenant service provider setup. A collector is necessary to efficiently gather logs before forwarding them to the FortiSIEM cluster.

Show Answer

Question: 4

Refer to the exhibit.

q4_FCSS_ADA_AR-6.7

Why was this incident auto cleared?

AWithin five minutes, the packet loss percentage dropped to a level where the host IP of the original rule matches the host IP of the clear condition pattern

BWithin five minutes the packet loss percentage dropped to a level where the reporting IP is the same as the host IP

CThe original rule did not trigger within five minutes

DWithin five minutes, the packet loss percentage dropped to a level where the reporting IP is same as the source IP
From the 'Clear If' condition in the exhibit:
WITHIN 5 minutes, the system checks if the pattern AllPingLossSrv_CLEAR occurs.
The Host IP of the clear condition must match the Host IP of the original rule (Clear_Condition.Host IP = Original_Rule.Host IP).
If this condition is met, the system automatically clears the incident because it indicates that network connectivity has been restored (packet loss has dropped).
Thus, the incident was auto-cleared because the system detected that the issue was resolved within the defined 5-minute window, meeting the conditions for auto-clearance.

Show Answer

Question: 5

In a customer network that includes a collector, which device performs device discoveries?

AAgent

BSupervisor

CWorker

DCollector
In a FortiSIEM deployment, device discovery is handled by the Supervisor, even when a Collector is present.
The Supervisor initiates active scans using protocols such as SNMP, WMI, SSH, and API queries to discover devices in the network.
Collectors do not perform discovery; they primarily collect and forward logs from designated devices to the Supervisor.
Workers handle event processing, not discovery.

Show Answer

Fortinet FCSS_ADA_AR-6.7 Quiz:1 Topic:4 Questions:1-5