Free Fortinet FCSS_ADA_AR-6.7 Exam Questions

Become Fortinet Certified with updated FCSS_ADA_AR-6.7 exam questions and correct answers

Page: 1 / 23

Total 112 Questions | Updated On: Oct 29, 2025

Add To Cart

Question 1

Refer to the exhibit.Why was this incident auto cleared?

A : Within five minutes, the packet loss percentage dropped to a level where the host IP of the original rule matches the host IP of the clear condition pattern

B : Within five minutes the packet loss percentage dropped to a level where the reporting IP is the same as the host IP

C : The original rule did not trigger within five minutes

D : Within five minutes, the packet loss percentage dropped to a level where the reporting IP is same as the source IP

Answer: A

Question 2

Which statement accurately contrasts lookup tables with watchlists?

A : Lookup table values age out after a period, whereas watchlist values do not have any time condition.

B : You can populate lookup tables through an incident, whereas you cannot populate watchlists through an incident.

C : Lookup tables can contain multiple columns, whereas watchlists contain only a single column.

D : You can reference lookup table data in analytic queries and reports almost immediately, whereas you may have to wait up to 5-10 minutes for watchlist entries to be useable in queries and reports.

Answer: C

Question 3

For effective rule construction in FortiSIEM, it's essential to consider:

A : The expected behavior of users in the network?

B : The specific brands of devices in the environment?

C : Known patterns of malicious activities?

D : The latest threats detailed in the MITRE ATT&CK® framework?

Answer: A,C,D

Question 4

Refer to the exhibit.Consider a nested event query where both inner and outer queries are event queries. Reporting IP is selected from the CMDB group Network Device, Event Type is selected from the CMDB group Logon Success, and Source IP is selected from the report Failed Logons to Network Devices. An administrator is about to execute the nested query. The report time ranges must be set before execution. The Nested Time Range will be applied to which attributes?

A : The nested time range will be configured for the Reporting IP attribute.

B : The nested time range will be configured for the Reporting IP and Event Type attributes.

C : The nested time range will be configured for the Source IP attribute.

D : The nested time range will be configured for the Event Type attribute.

Answer: C

Question 5

Refer to the exhibit. Which statement about the rule filters events shown in the exhibit is true?

A : The rule filters events with an event type that equals Domain Account Locked and a reporting IP that equals Domain Controller applications.

B : The rule filters events with an event type that belong to the Domain Account Locked CMDB group or a reporting IP that belong to the Domain Controller applications group.

C : The rule filters events with an event type that belong to the Domain Account Locked CMDB group and a reporting IP that belong to the Domain Controller applications group.

D : The rule filters events with an event type that belong to the Domain Account Locked CMDB group and a user that belongs to the Domain Controller applications group.

Answer: C

Page: 1 / 23

Total 112 Questions | Updated On: Oct 29, 2025

Add To Cart