Question 1

What happens to UEBA events when a user is off-net?

Options :

A : The agent will upload the events to the Worker if it cannot upload them to a FortiSIEM collector

B : The agent will upload the events to the Supervisor if it cannot upload them to a FortiSIEM collector

C : The agent will cache events locally if it cannot upload them to a FortiSIEM collector

D : The agent will drop the events if it cannot upload them to a FortiSIEM collector

Answer: C

Question 2

A service provider purchased a licensed EPS of 520 and the total unused events is 72,000. Calculate the total amount of allowed events for the next 3-minute interval.

Options :

A : 192,456

B : 192,442

C : 192,446

D : 192,450

Answer: A

Question 3

Which statement accurately contrasts lookup tables with watchlists?

Options :

A : Lookup table values age out after a period, whereas watchlist values do not have any time condition.

B : You can populate lookup tables through an incident, whereas you cannot populate watchlists through an incident.

C : Lookup tables can contain multiple columns, whereas watchlists contain only a single column.

D :

You can reference lookup table data in analytic queries and reports almost immediately, whereas you may have to wait up to 5-10 minutes for watchlist entries to be useable in queries and reports.

Answer: C

Question 4

What is the primary function of FortiSIEM rule processing?

Options :

A : To archive older log entries for storage?

B : To ensure smooth communication between FortiSIEM components?

C : To organize logs by timestamp?

D : To determine the actions to take based on observed events?

Answer: D

Question 5

What are the benefits of configuring UEBA on FortiSIEM?

Options :

A : Enhanced encryption algorithms for data at rest?

B : Improved detection of insider threats?

C : Automated response to all network events?

D : Ability to spot unusual behavior patterns of users and entities?

Answer: B,D