FCSS-ADA-AR-6-7 Sample Questions & Answers

The correct syntax for retrieving a value from a lookup table in FortiSIEM is LOOKUP(tableName, eventAttributeToMatch, tableColumnToMatch, tableColumnToReturn). In this scenario, AppOwners is the table name, srcIp is the event attribute, IP_Address is the key column in the lookup table, and AppOwnerEmail is the value column to be returned and added to the event.

The User Behavior Model is specifically designed to learn the normal patterns of activity for individual users. It would establish a baseline for each administrator, including the typical number and type of patient records they access. A sudden, significant deviation from this learned behavior, such as accessing a much higher volume of unique records, would be flagged as a high-risk anomaly, indicative of potential account compromise.

For FortiSIEM to execute a remediation script, the script file itself must have the correct Linux file permissions (typically chmod 755) and be owned by the appropriate user (usually phoenix). This is a common and fundamental configuration issue that prevents script execution. Checking permissions is the most logical and effective first troubleshooting step before investigating more complex issues like API keys or network connectivity.

FortiSIEM uses a powerful XML-based language to define log parsers. For custom or bespoke log sources, an administrator must create a new parser XML file. This file defines the regular expressions, patterns, and logic needed to extract attributes from raw logs. This parser is then uploaded to the Supervisor and distributed to the appropriate Collectors, which use it to process incoming logs.

This rule requires matching two distinct conditions in a specific sequence and timeframe: a pattern of failed logins AND a pattern of a successful login. Because it involves more than one pattern or condition that must be met, it is classified as a multiple subpattern rule. This type of rule is essential for detecting complex attack sequences like brute-force attempts.

The learning period is a defined timeframe during which FortiSIEM observes and collects data for a specific metric (e.g., traffic volume, login failures) without generating alerts. It uses this data to build a statistical model of what constitutes normal activity. Once the learning period is complete, this model becomes the baseline against which future activity is compared to detect anomalies.

A decision node in a FortiSOAR playbook is used to create conditional branches in the workflow. It evaluates an input, such as the severity attribute from a FortiSIEM incident, and directs the playbook execution down a specific path based on whether the condition is true or false. This allows for the creation of dynamic and context-aware automation.

The FortiSIEM agent runs as a specific user. If that user does not have read permissions on the log files or directories specified in its configuration (/opt/fortisiem-agent/etc/config.xml), it will be unable to access and forward the log data, even if the process is running and network connectivity is fine. This is a common OS-level configuration error.

This structure is the most efficient. The inner CMDB query (deviceType = 'Domain Controller') executes first and returns a relatively small, targeted list of device IPs. The outer event query then searches only for events from that specific list of IPs where the user is 'j.doe'. This significantly reduces the search space for the event query compared to searching all events first and then filtering. Using a nested query to pre-filter from the CMDB is a key optimization technique.

This is the core difference. A standard report provides a straightforward aggregation of data (e.g., top talkers, event counts). A baseline report, however, compares current data against a previously established statistical baseline of normal behavior and highlights significant deviations, which are potential anomalies.