Question 1

What are the two SQLite databases that are used for baseline data? (Choose two.)

Options :

A : Event database

B : Daily database

C : Weekly database

D : Profile database

Answer: B,D

Question 2

UEBA in the context of FortiSIEM stands for:

Options :

A : User and Entity Behavior Analytics?

B : User Event Baseline Algorithm?

C : Unified Endpoint Baseline Assessment?

D : Unified Encryption Behavior Analysis?

Answer: A

Question 3

What happens to UEBA events when a user is off-net?

Options :

A : The agent will upload the events to the Worker if it cannot upload them to a FortiSIEM collector

B : The agent will upload the events to the Supervisor if it cannot upload them to a FortiSIEM collector

C : The agent will cache events locally if it cannot upload them to a FortiSIEM collector

D : The agent will drop the events if it cannot upload them to a FortiSIEM collector

Answer: C

Question 4

Refer to the exhibit.

An administrator wants to remediate the incident from FortiSIEM shown in the exhibit. What option is available to the administrator?

Options :

A : Quarantine IP FortiClient

B : Run the block domain Windows DNS

C : Run the block MAC FortiOS

D : Run the block IP FortiOS 5.4

Answer: D

Question 5

Which statement accurately contrasts lookup tables with watchlists?

Options :

A : Lookup table values age out after a period, whereas watchlist values do not have any time condition.

B : You can populate lookup tables through an incident, whereas you cannot populate watchlists through an incident.

C : Lookup tables can contain multiple columns, whereas watchlists contain only a single column.

D :

You can reference lookup table data in analytic queries and reports almost immediately, whereas you may have to wait up to 5-10 minutes for watchlist entries to be useable in queries and reports.

Answer: C