Question 1

For effective rule construction in FortiSIEM, it's essential to consider:

Options :

A : The expected behavior of users in the network?

B : The specific brands of devices in the environment?

C : Known patterns of malicious activities?

D : The latest threats detailed in the MITRE ATT&CK® framework?

Answer: A,C,D

Question 2

Which organization do agents belong to after registration? (Choose two.)

Options :

A : The windows agents belong to the super organization.

B :

The agents belong to the organization specified in the agent installation setup wizard for Windows platforms.

C : The Linux agents belong to the super local organization.

D :

The agents belong to the organization specified in the command line parameters for Linux platforms.

Answer: D

Question 3

A service provider purchased a licensed EPS of 520 and the total unused events is 72,000. Calculate the total amount of allowed events for the next 3-minute interval.

Options :

A : 192,456

B : 192,442

C : 192,446

D : 192,450

Answer: A

Question 4

UEBA in the context of FortiSIEM stands for:

Options :

A : User and Entity Behavior Analytics?

B : User Event Baseline Algorithm?

C : Unified Endpoint Baseline Assessment?

D : Unified Encryption Behavior Analysis?

Answer: A

Question 5

Refer to the exhibit.

Which statement about the rule filters events shown in the exhibit is true?

Options :

A :

The rule filters events with an event type that equals Domain Account Locked and a reporting IP that equals Domain Controller applications.

B :

The rule filters events with an event type that belong to the Domain Account Locked CMDB group or a reporting IP that belong to the Domain Controller applications group.

C :

The rule filters events with an event type that belong to the Domain Account Locked CMDB group and a reporting IP that belong to the Domain Controller applications group.

D :

The rule filters events with an event type that belong to the Domain Account Locked CMDB group and a user that belongs to the Domain Controller applications group.

Answer: C