Refer to the exhibit.Which devices will be added to the CMDB and mapped to Customer E?
Answer(s): B,D
From the exhibit, we can determine the IP range that will be added to the CMDB and mapped to Customer E.The included IP range is 10.50.0.1 10.50.0.50.This means any device within this range (10.50.0.1 to 10.50.0.50) will be added to the CMDB. 10.50.0.1 Falls within the included range (10.50.0.1 10.50.0.50) Added to CMDB. 10.50.0.149 Falls within the 10.50.0.1 10.50.0.50 range Added to CMDB.
Refer to the exhibit.An administrator applies the rule exception shown in the exhibit. How does this configuration impact the incident generation for that rule?
Answer(s): A
From the exhibit, the rule exception is set for:Time Range: Starts at 00:00:00Duration: 2 daysRecurrence Pattern: December 25th and December 26thThis means that during these two days (every year in December), the rule will not trigger incidents. Rule exceptions temporarily suppress incident generation during the specified period. Events are still processed, but no incidents are generated.
Which two statements about phRuleWorker are true? (Choose two.)
Answer(s): A,C
phRuleWorker processes events in 60-second intervals (buckets). This means that events within a one-minute window are evaluated together for rule conditions, helping detect patterns, correlations, and triggers.phRuleWorker runs both on the supervisor and worker nodes to distribute event processing. The supervisor primarily orchestrates rule evaluation, while workers handle distributed event processing.
Refer to the exhibit.Which three fields from the organization destination are required while registering a collector? (Choose three.)
Answer(s): B,D,E
The admin password is a mandatory field, as indicated in the exhibit ("Required" in red). It is needed for authentication and administrative access.The organization name ("University") is necessary to associate the collector with the correct organization.The Admin User (uniadmin) is a required field for defining the administrator of the collector.
FortiSIEM provides all rules with the ability to automatically change an active incident status to auto- cleared, based on an extra set of defined criteria.Why would you configure FortiSIEM to automatically change an active incident status to auto- cleared?
In FortiSIEM, some incidents may be triggered due to temporary threshold breaches, especially in availability or performance-related monitoring. These temporary anomalies do not necessarily indicate a persistent issue or security threat.By automatically clearing such incidents, FortiSIEM prevents unnecessary manual intervention and reduces noise in incident management.
Post your Comments and Discuss Fortinet FCSS_ADA_AR-6.7 exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the FCSS_ADA_AR-6.7 content, but please register or login to continue.