Free FCSS-ADA-AR-6-7 sample questions

Correct answer: The 14-day learning period was too short to capture normal monthly variations in transaction failures.

Baseline profiles learn 'normal' behavior during the learning period. For business cycles that have weekly or monthly patterns (like spikes in transactions at the end of a month), a 14-day period may not be sufficient. It could establish a baseline that is too low, causing normal cyclical peaks to be flagged as anomalies. Extending the learning period to capture a full business cycle (e.g., 30-45 days) would create a more accurate profile.

Correct answer: The FortiSIEM incident does not contain the necessary attributes (like Host IP or MAC address) required by the playbook's input parameters.

FortiSOAR playbooks often require specific data points (artifacts) from the incoming alert to function correctly. If a playbook is designed to isolate a host, it will need an IP address, hostname, or MAC address as an input. If the FortiSIEM incident notification is not configured to send these specific attributes, the playbook will be triggered but will fail at the step that requires this missing information. A successful connector test only confirms connectivity, not the correctness of the data payload.

Correct answer: False

FortiSIEM's multi-tenancy model enforces strict data isolation between customer organizations. When an administrator creates a resource like a report and associates it with a specific organization, it is only visible to users within that organization's scope and to Super/MSSP level administrators. This role-based access control (RBAC) and organizational scoping are fundamental to the security of an MSSP offering.

Correct answer: LOOKUP(AppOwners, srcIp, IP_Address, AppOwnerEmail)

The correct syntax for retrieving a value from a lookup table in FortiSIEM is `LOOKUP(tableName, eventAttributeToMatch, tableColumnToMatch, tableColumnToReturn)`. In this scenario, `AppOwners` is the table name, `srcIp` is the event attribute, `IP_Address` is the key column in the lookup table, and `AppOwnerEmail` is the value column to be returned and added to the event.

Correct answer: User Behavior Model

The User Behavior Model is specifically designed to learn the normal patterns of activity for individual users. It would establish a baseline for each administrator, including the typical number and type of patient records they access. A sudden, significant deviation from this learned behavior, such as accessing a much higher volume of unique records, would be flagged as a high-risk anomaly, indicative of potential account compromise.

Correct answer: Verify the script has executable permissions and the correct ownership on the FortiSIEM appliance.

For FortiSIEM to execute a remediation script, the script file itself must have the correct Linux file permissions (typically `chmod 755`) and be owned by the appropriate user (usually `phoenix`). This is a common and fundamental configuration issue that prevents script execution. Checking permissions is the most logical and effective first troubleshooting step before investigating more complex issues like API keys or network connectivity.

Correct answer: A custom XML-based parser definition uploaded to the Supervisor.

FortiSIEM uses a powerful XML-based language to define log parsers. For custom or bespoke log sources, an administrator must create a new parser XML file. This file defines the regular expressions, patterns, and logic needed to extract attributes from raw logs. This parser is then uploaded to the Supervisor and distributed to the appropriate Collectors, which use it to process incoming logs.

Correct answer: A multiple subpattern rule

This rule requires matching two distinct conditions in a specific sequence and timeframe: a pattern of failed logins AND a pattern of a successful login. Because it involves more than one pattern or condition that must be met, it is classified as a multiple subpattern rule. This type of rule is essential for detecting complex attack sequences like brute-force attempts.

Correct answer: To allow the system to gather data and statistically define 'normal' behavior for a specific metric.

The learning period is a defined timeframe during which FortiSIEM observes and collects data for a specific metric (e.g., traffic volume, login failures) without generating alerts. It uses this data to build a statistical model of what constitutes normal activity. Once the learning period is complete, this model becomes the baseline against which future activity is compared to detect anomalies.

Correct answer: A decision node

A decision node in a FortiSOAR playbook is used to create conditional branches in the workflow. It evaluates an input, such as the `severity` attribute from a FortiSIEM incident, and directs the playbook execution down a specific path based on whether the condition is true or false. This allows for the creation of dynamic and context-aware automation.