Pass the Fortinet Fortinet Certified Professional Security Operations FCSS_ADA_AR-6.7 Questions and answers with CertsForce

EPS burstingin FortiSIEM allows temporary spikes in events per second (EPS) beyond the licensed limit, but only if there areaccumulated unused EPS credits. This ensures flexibility in handling short-term surges without requiring a permanent license upgrade.

● FortiSIEMaccumulates unused EPS creditswhen actual EPS usage is below the licensed limit.

● When anevent surgeoccurs, FortiSIEM canburst up to 5x the licensed EPS,but only if there are sufficient accumulated credits.

This allowsadaptive scalingwhile preventing abuse of resources beyond allocated licensing.

FortiSIEM's User and Entity Behavior Analytics (UEBA) uses AI-driven modeling to detect anomalies and security risks based on user activity. The risk weighting for UEBA tags allows customization of the AI model by prioritizing certain behaviors or indicators over others.

Adjusting risk weightings fine-tunes how the AI model evaluates risk, helping organizations align detection sensitivity with their security policies. This provides a customized risk scoring mechanism without requiring full AI retraining.

The rule is tracking asudden increase in WMI response timesover a30-minute window. The key detail here is the increase factor.

● The term1.50 times increasemeans the new value is150%of the previous baseline.

● A1.50x increasecorresponds to a150% increase, since the new value isoriginal + 150% of original.

From the"Clear If"condition in the exhibit:

●WITHIN 5 minutes, the system checks if the patternAllPingLossSrv_CLEARoccurs.

● TheHost IP of the clear condition must match the Host IP of the original rule(Clear_Condition.Host IP = Original_Rule.Host IP).

● If this condition is met, the systemautomatically clears the incidentbecause it indicates that network connectivity has been restored (packet loss has dropped).

Thus, theincident was auto-clearedbecause the system detected that the issue was resolved within the defined5-minute window, meeting the conditions for auto-clearance.

Therule engineinFortiSIEMloadsbaseline data valuesfrom theprofile database. This database stores historical trends and behavioral baselines for various metrics, such asCPU usage, network activity, and authentication patterns.

●Profile databasemaintainslong-term aggregated statisticsfor anomaly detection.

●Baseline valuesare used to comparecurrent eventsagainst expected behavior.

● This helps indetecting deviations, such as a sudden increase in failed logins or unusual traffic spikes.

The exhibit shows the directory listings forthree different workers(worker1,worker2, andworker3) under the/querywkr/active/13127*path, which indicatesactive query tasksassigned to each worker.

1.Worker1 (worker1)

The output doesnotshow any subdirectories or task files (13127t0,13127t1, etc.), meaningWorker1 is not assigned any tasks.

2.Worker2 (worker2)

The output showsone task (13127t1)under/querywkr/active/13127*.

The workerhas only one assigned task, not two, so optionsC and D are incorrect.

3.Worker3 (worker3)

The output showstwo tasks (13127t0and13127t1), indicating that Worker3 is processingtwo tasksfor query ID 13127.

In a nested event query, the inner query executes first, and its results feed into the outer query. Since the Source IP comes from the report "Failed Logons to Network Devices", which is part of the inner query, the nested time range applies to it. The other attributes, Reporting IP and Event Type, belong to the outer query and are not affected by the nested time range.

InFortiSIEM baselining, anhourly bucketis used to maintainhourly-specific statistical baselines. This helps detect anomalies by comparing current activity against historical norms foreach hour of the day, separately forweekdays and weekends.

The system maintainshourly profiles, ensuring that anomalies are detected based on similar timeframes. This approach prevents false positives due to natural variations in network activity across different times of the day and different days of the week.

Collaborative knowledge sharing: FortiSOAR enables security teams to share knowledge, automate workflows, and improve incident response efficiency by centralizing intelligence and standardizing processes.

Addressing analyst skills gap: By automating repetitive tasks and providing guided response playbooks, FortiSOAR helps SOC teams compensate for skill shortages and improve operational effectiveness.

Reducing human error: Automation and predefined workflows minimize manual interventions, reducing the likelihood of errors in incident detection, response, and remediation.

phRuleWorker processes events in 60-second intervals (buckets). This means that events within a one-minute window are evaluated together for rule conditions, helping detect patterns, correlations, and triggers.

phRuleWorker runs both on the supervisor and worker nodes to distribute event processing. The supervisor primarily orchestrates rule evaluation, while workers handle distributed event processing.