2023年11月最新のFortinet NSE7_ADA-6.3問題集で更新された36問あります
PDF無料ダウンロードにはNSE7_ADA-6.3有効な練習テスト問題
質問 # 18
What happens to UEBA events when a user is off-net?
- A. The agent will upload the events to the Supervisor if it cannot upload them to a FortiSIEM collector
- B. The agent will drop the events if it cannot upload them to a FortiSIEM collector
- C. The agent will upload the events to the Worker if it cannot upload them to a FortiSIEM collector
- D. The agent will cache events locally if it cannot upload them to a FortiSIEM collector
正解：D
解説：
Explanation
When a user is off-net, meaning they are not connected to a network where a FortiSIEM collector is reachable, then UEBA events will be cached locally by the agent if it cannot upload them to a FortiSIEM collector. The agent will store up to 100 MB of events in a local database file and try to upload them when it detects a network change or every five minutes.
質問 # 19
Refer to the exhibit. Click on the calculator button.
The profile database contains CPU utilization values from day one. At midnight on the second day, the CPU utilization values from the daily database will be merged with the profile database.
In the profile database, in the Hour of Day column where 9 is the value, what will be the updated minimum, maximum, and average CPU utilization values?
- A. Min CPU Util=33.50, Max CPU Ucil=33.50 and AVG CPU Util=33.50
- B. Min CPU Util=32.31, Max CPU Ucil=33.50 and AVG CPU Util=33.50
- C. Min CPU Util=32.31, Max CPU Ucil=32.31 and AVG CPU Util=32.31
- D. Min CPU Util=32.31, Max CPU Ucil=33.50 and AVG CPU Util=32.67
正解：D
解説：
Explanation
The profile database contains CPU utilization values from day one. At midnight on the second day, the CPU utilization values from the daily database will be merged with the profile database using a weighted average formula:
New value = (Old value x Old weight) + (New value x New weight) / (Old weight + New weight) The weight is determined by the number of days in each database. In this case, the profile database has one day of data and the daily database has one day of data, so the weight is equal for both databases. Therefore, the formula simplifies to:
New value = (Old value + New value) / 2
In the profile database, in the Hour of Day column where 9 is the value, the updated minimum, maximum, and average CPU utilization values are:
Min CPU Util = (32.31 + 32.31) / 2 = 32.31 Max CPU Util = (33.50 + 33.50) / 2 = 33.50 AVG CPU Util = (32.67 + 32.67) / 2 = 32.67
質問 # 20
Which of the following are two Tactics in the MITRE ATT&CK framework? (Choose two.)
- A. Phishing
- B. Reconnaissance
- C. BITS Jobs
- D. Discovery
- E. Root kit
正解：B、D
解説：
Explanation
Reconnaissance and Discovery are two Tactics in the MITRE ATT&CK framework. Tactics are the high-level objectives of an adversary, such as initial access, persistence, lateral movement, etc. Reconnaissance is the tactic of gathering information about a target before launching an attack. Discovery is the tactic of exploring a compromised system or network to find information or assets of interest. References: Fortinet NSE 7 - Advanced Analytics 6.3 Exam Description, page 21
質問 # 21
Refer to the exhibit.
Why is the windows device still in the CMDB, even though the administrator uninstalled the windows agent?
- A. The device must be deleted from backend of FortiSIEM
- B. The device must be deleted manually from the CMDB
- C. The device has performance jobs assigned
- D. The device was not uninstalled properly
正解：B
解説：
Explanation
The windows device is still in the CMDB, even though the administrator uninstalled the windows agent, because the device must be deleted manually from the CMDB. Uninstalling the windows agent does not automatically remove the device from the CMDB, as there may be other sources of data for the device, such as SNMP or syslog. To delete the device from the CMDB, the administrator must go to CMDB > Devices > All Devices, select the device, and click Delete.
質問 # 22
Refer to the exhibit.
An administrator wants to remediate the incident from FortiSIEM shown in the exhibit.
What option is available to the administrator?
- A. Run the block domain Windows DNS
- B. Run the block IP FortiOS 5.4
- C. Quarantine IP FortiClient
- D. Run the block MAC FortiOS.
正解：B
解説：
Explanation
The incident from FortiSIEM shown in the exhibit is a brute force attack on a FortiGate device. The remediation option available to the administrator is to run the block IP FortiOS 5.4 action, which will block the source IP address of the attacker on the FortiGate device using a firewall policy.
質問 # 23
From where does the rule engine load the baseline data values?
- A. The daily database
- B. The profile report
- C. The memory
- D. The profile database
正解：D
解説：
Explanation
The rule engine loads the baseline data values from the profile database. The profile database contains historical data that is used for baselining calculations, such as minimum, maximum, average, standard deviation, and percentile values for various metrics.
質問 # 24
Refer to the exhibit.
Which statement about the rule filters events shown in the exhibit is true?
- A. The rule filters events with an event type that belong to the Domain Account Locked CMDB group or a reporting IP that belong to the Domain Controller applications group.
- B. The rule filters events with an event type that belong to the Domain Account Locked CMDB group and a user that belongs to the Domain Controller applications group.
- C. The rule filters events with an event type that equals Domain Account Locked and a reporting IP that equals Domain Controller applications.
- D. The rule filters events with an event type that belong to the Domain Account Locked CMDB group and a reporting |P that belong to the Domain Controller applications group.
正解：D
解説：
Explanation
The rule filters events with an event type that belong to the Domain Account Locked CMDB group and a reporting IP that belong to the Domain Controller applications group. This means that only events that have both criteria met will be processed by this rule. The event type and reporting IP are joined by an AND operator, which requires both conditions to be true.
質問 # 25
Refer to the exhibit.
How long has the UEBA agent been operationally down?
- A. 2 Hours
- B. 9 Hours
- C. 20 Hours
- D. 21 Hours
正解：D
解説：
Explanation
The UEBA agent status shows that it has been operationally down for one day and three hours ago (1d3h).
This means that it has been down for 24 hours plus three hours, which is equal to 21 hours.
質問 # 26
Refer to the exhibit.
The exhibit shows the output of an SQL command that an administrator ran to view the natural_id value, after logging into the Postgres database.
What does the natural_id value identify?
- A. An agent
- B. The collector
- C. The supervisor
- D. The worker
正解：B
解説：
Explanation
The natural_id value identifies the collector in the FortiSIEM system. The natural_id is a unique identifier that is assigned to each collector during the registration process with the supervisor. The natural_id is used to associate events and performance data with the collector that collected them.
質問 # 27
Which syntax will register a collector to the supervisor?
- A. phProvisionCollector --add
- B. phProvisionCollector --add
- C. phProvisionCollector --add
- D. phProvisionCollector --add
正解：B
解説：
Explanation
The syntax that will register a collector to the supervisor is phProvisionCollector --add <supervisor IP>. This command will initiate the registration process between the collector and the supervisor, and exchange certificates and configuration information. The <supervisor IP> parameter is the IP address of the supervisor node.
質問 # 28
Refer to the exhibit.
The window for this rule is 30 minutes.
What is this rule tracking?
- A. A sudden 1.50 times increase in WMI response times over a 30-minute time window
- B. A sudden 150% increase in WMI response times over a 30-minute time window
- C. A sudden 75% increase in WMI response times over a 30-minute time window
- D. A sudden 50% increase in WMI response times over a 30-minute time window
正解：A
解説：
Explanation
The rule is tracking the WMI response times from Windows devices using a baseline calculation. The rule will trigger an incident if the current WMI response time is greater than or equal to 1.50 times the average WMI response time in the last 30 minutes.
質問 # 29
Identify the processes associated with Machine Learning/Al on FortiSIEM. (Choose two.)
- A. phAnomaly
- B. phRuleMaster
- C. phReportMaster
- D. phFortiInsightAI
- E. phRuleWorker
正解：A、D
解説：
Explanation
The processes associated with Machine Learning/AI on FortiSIEM are phFortiInsightAI and phAnomaly.
phFortiInsightAI is responsible for detecting anomalous user behavior using UEBA (User and Entity Behavior Analytics) techniques. phAnomaly is responsible for detecting anomalous network behavior using NTA (Network Traffic Analysis) techniques.
質問 # 30
Which statement about EPS bursting is true?
- A. FortiSIEM must be provisioned with ten percent the licensed EPS to handle potential event surges.
- B. FortiSIEM will let you burst up to five times the licensed EPS once during a 24-hour period.
- C. FortiSIEM will let you burst up to five times the licensed EPS at any given time, provided it has accumulated enough unused EPS.
- D. FortiSIEM will let you burst up to five times the licensed EPS at any given time, regardless of unused of EPS.
正解：C
解説：
Explanation
FortiSIEM allows EPS bursting to handle event spikes without dropping events or violating the license agreement. EPS bursting means that FortiSIEM will let you burst up to five times the licensed EPS at any given time, provided it has accumulated enough unused EPS from previous time intervals.
質問 # 31
Refer to the exhibit.
If the Z-score for this rule is greater than or equal to three, what does this mean?
- A. The rate of firewall connection is below historical average value.
- B. The rate of firewall connection is above the historical average value.
- C. The rate of firewall connection is optimum.
- D. The rate of firewall connection is above the current average value.
正解：B
解説：
Explanation
If the Z-score for this rule is greater than or equal to three, it means that the rate of firewall connection is above the historical average value. The Z-score is a measure of how many standard deviations a value is away from the mean of a distribution. A Z-score of three or more indicates that the value is significantly higher than the mean, which implies an anomaly or deviation from normal behavior.
質問 # 32
......
NSE7_ADA-6.3テストエンジンお試しセット、NSE7_ADA-6.3問題集PDF：https://www.goshiken.com/Fortinet/NSE7_ADA-6.3-mondaishu.html
最新のFortinet NSE7_ADA-6.3のPDFと問題集で（2023）無料試験問題解答はここ：https://drive.google.com/open?id=1G3WWk-YTwOcWIt_5Py1wvjEwpQRNNHRq