Question 1

What are two reasons that agents maintain communication with the supervisor after registration? (Choose two.)

Options :

A : To collect new agent template

B : To report health and its status

C : To report incoming EPS value

D : To report logs and events

Answer: A,B

Question 2

UEBA in the context of FortiSIEM stands for:

Options :

A : User and Entity Behavior Analytics?

B : User Event Baseline Algorithm?

C : Unified Endpoint Baseline Assessment?

D : Unified Encryption Behavior Analysis?

Answer: A

Question 3

Refer to the exhibit.

This is an example of a baseline profile that is configured in the backend of FortiSIEM. Which two Group By attributes are configured for this profile? (Choose two.)

Options :

A : Logon Failure

B : Reporting Device

C : Reporting IP

D : Distinct User

Answer: B,C

Question 4

Refer to the exhibit.

Which statement about the rule filters events shown in the exhibit is true?

Options :

A :

The rule filters events with an event type that equals Domain Account Locked and a reporting IP that equals Domain Controller applications.

B :

The rule filters events with an event type that belong to the Domain Account Locked CMDB group or a reporting IP that belong to the Domain Controller applications group.

C :

The rule filters events with an event type that belong to the Domain Account Locked CMDB group and a reporting IP that belong to the Domain Controller applications group.

D :

The rule filters events with an event type that belong to the Domain Account Locked CMDB group and a user that belongs to the Domain Controller applications group.

Answer: C

Question 5

When automating remediation in FortiSIEM, what should be carefully considered?

Options :

A : The potential impact of the automated action on business operations?

B : The aesthetic layout of the FortiSIEM dashboard?

C : The frequency of software updates?

D : The number of users currently logged in?

Answer: A