FCSS_ADA_AR-6.7 Exam Dumps - Fortinet Certified Solution Specialist Questions and Answers

The exhibit shows a FortiSIEM cluster deployed in a multi-tenant service provider environment, serving multiple customers. The architecture includes:

1. Customers with Collectors

Customer A and Customer B (AWS) have collectors deployed within their environments.

Collectors gather and forward logs to the FortiSIEM cluster for centralized analysis.

2. Customers Without Collectors

Customer C does not have a collector; instead, it sends logs directly to the FortiSIEM cluster.

3. Super Organization Managing Infrastructure

The service provider infrastructure devices (e.g., networking and security appliances) are managed directly by the FortiSIEM cluster.

This mixed setup, where some customers use collectors while others send logs directly, represents a hybrid deployment with and without collectors.

The rule is tracking asudden increase in WMI response timesover a30-minute window. The key detail here is the increase factor.

● The term1.50 times increasemeans the new value is150%of the previous baseline.

● A1.50x increasecorresponds to a150% increase, since the new value isoriginal + 150% of original.

FortiSOAR supports multipledata ingestion modesto allow efficient data collection and automation. The three primary modes are:

1.Rule-Based

FortiSOAR ingests data when specific rules are triggered based on defined conditions.

This enables automation and intelligence-driven event ingestion.

2.App Push

External applications canpushdata into FortiSOAR usingAPIs and integrations.

This is useful forreal-time ingestionfrom external tools like SIEMs, ticketing systems, and threat intelligence platforms.

3.Schedule-Based

Data is ingested based onpredefined schedules.

This is useful for periodic polling of external systems, fetching logs, and running automated tasks at set intervals.

InFortiSIEM baselining, anhourly bucketis used to maintainhourly-specific statistical baselines. This helps detect anomalies by comparing current activity against historical norms foreach hour of the day, separately forweekdays and weekends.

The system maintainshourly profiles, ensuring that anomalies are detected based on similar timeframes. This approach prevents false positives due to natural variations in network activity across different times of the day and different days of the week.

When registeringagentsin FortiSIEM, the organization to which they belong depends on how they are installed:

●Windows Agents

● During installation, the setup wizard prompts the user to specify theorganization.

● This ensures the agent is correctly assigned to the organization defined during setup.

●Linux Agents

● Installation on Linux requirescommand-line parameters, including theorganization name.

● This means that the organization is explicitly defined during the installation process.

The phProvisionCollector command is used to register a collector to the supervisor in FortiSIEM. The correct syntax requires:

● User → The admin username for authentication.

● Password → The password for authentication.

● Super IP → The IP address of the supervisor, which manages the collector.

● Organization → The organization to which the collector belongs.

● Worker Name → The name of the worker node responsible for handling events from this collector.

In a multi-tenant FortiSOAR deployment, a Managed Security Service Provider (MSSP) hosts a shared FortiSOAR instance that serves multiple customers. Each customer operates as a separate tenant within the instance, ensuring data isolation and security.

FortiSOAR uses secure network connectivity (VPNs, direct connections, or secure tunnels) between the MSSP’s FortiSOAR manager node and the customer’s devices.

The customer does not need to install additional software or tenant nodes; instead, the MSSP manages multi-tenancy at the platform level.

The administratordeployed FortiSIEM without a collector, meaning there is no dedicated system collecting logs fromservice provider infrastructure devices. Without a collector, the FortiSIEMsupervisor and workersmust directly ingest logs, which is not ideal for amulti-tenant service provider setup. Acollector is necessaryto efficiently gather logs before forwarding them to the FortiSIEM cluster.

From the provided XML configuration, we need to focus on the section, which defines the attributes used for grouping.

In theSelectClause, the following attributes are listed:

reptDevName, reptDevAddr, COUNT(*), COUNT(DISTINCT user), COUNT(DISTINCT srcIpAddr)

●reptDevNamerepresents thereporting device.

●reptDevAddrrepresents thereporting IP.

●COUNT(DISTINCT user)tracks unique users.

●COUNT(DISTINCT srcIpAddr)tracks distinct source IPs.

In theGroupByAttrsection:

reptDevName, reptDevAddr

This confirms that the grouping is performed byReporting Device (reptDevName)andReporting IP (reptDevAddr).

The incident shown in the exhibit indicates that a firewall detected malware but could not remediate it. The firewall identified the EICAR_TEST_FILE virus and logged the source IP (10.0.3.10) as the origin of the threat.

To remediate this, the administrator should take action at the network level, specifically using FortiOS to block the source IP address. The option "Run the block IP FortiOS 5.4" provides the ability to block traffic from the infected IP at the firewall level, effectively preventing further threats from that source.