FCSS_ADA_AR-6.7 Fortinet FCSS Advanced Analytics 6.7 Architect Free Practice Exam Questions (2025 Updated)

Lookup tables and watchlists serve different purposes in Fortinet’s Advanced Analytics:

● Lookup tables allow for structured data storage with multiple columns, making them useful for correlating different attributes or key-value pairs.

● Watchlists are simpler and contain only a single column, often used for quick reference to flagged values, such as IP addresses or user accounts.

TheWindows agent (fortibank_dc.fortibank.net)is in an"Unmanaged"state, which indicates that it has not received amonitoring templatefrom FortiSIEM. Without a template, the agent does not know what logs to collect or forward, meaning it isnot sending logs to the supervisor.

Theagent is registered, meaning it has completed the installation and connection process. Since it isunmanaged, it isnot actively monitoredor configured to send logs. To resolve this, the administrator mustassign a monitoring templateto enable proper log forwarding.

From the provided XML configuration, we need to focus on the section, which defines the attributes used for grouping.

In theSelectClause, the following attributes are listed:

reptDevName, reptDevAddr, COUNT(*), COUNT(DISTINCT user), COUNT(DISTINCT srcIpAddr)

●reptDevNamerepresents thereporting device.

●reptDevAddrrepresents thereporting IP.

●COUNT(DISTINCT user)tracks unique users.

●COUNT(DISTINCT srcIpAddr)tracks distinct source IPs.

In theGroupByAttrsection:

reptDevName, reptDevAddr

This confirms that the grouping is performed byReporting Device (reptDevName)andReporting IP (reptDevAddr).

The rule triggers an incident when there are two or more VPN logon failures within a 10-minute window, grouped by Source IP, Reporting Device, Reporting IP, and User. Let's analyze the events:

Breakdown of Events:

1. Reporting IP: 1.1.1.1, Source IP: 2.2.2.2, Device: FortiGate, User: Sarah

2. Reporting IP: 1.1.1.1, Source IP: 2.2.2.2, Device: FortiGate, User: John

3. Reporting IP: 1.1.1.3, Source IP: 2.2.2.2, Device: FortiGate2, User: Tom

4. Reporting IP: 1.1.1.3, Source IP: 2.2.2.2, Device: FortiGate2, User: John

5. Reporting IP: 1.1.1.3, Source IP: 2.2.2.2, Device: FortiGate2, User: Sarah

6. Reporting IP: 1.1.1.1, Source IP: 2.2.2.2, Device: FortiGate, User: Tom

Now, applying the grouping criteria (Source IP, Reporting Device, Reporting IP, and User):

● Group 1: (1.1.1.1, 2.2.2.2, FortiGate, John) → 1 occurrence (not enough)

● Group 2: (1.1.1.1, 2.2.2.2, FortiGate, Sarah) → 1 occurrence (not enough)

● Group 3: (1.1.1.1, 2.2.2.2, FortiGate, Tom) → 2 occurrences (incident triggered)

● Group 4: (1.1.1.3, 2.2.2.2, FortiGate2, John) → 2 occurrences (incident triggered)

● Group 5: (1.1.1.3, 2.2.2.2, FortiGate2, Sarah) → 1 occurrence (not enough)

● Group 6: (1.1.1.3, 2.2.2.2, FortiGate2, Tom) → 1 occurrence (not enough)

Final Incident Count:

● One incident for Group 3 (Tom on FortiGate)

● One incident for Group 4 (John on FortiGate2)

phRuleMaster runs on both the supervisor and worker nodes, allowing distributed event processing. It receives filtered data from phRuleWorkers and organizes it into buckets before evaluation. Every 30 seconds, it processes the rule data in parallel, ensuring efficient rule execution. The incorrect options suggest that phRuleMaster runs only on the supervisor or evaluates rules sequentially, both of which are inaccurate.

Therule engineinFortiSIEMloadsbaseline data valuesfrom theprofile database. This database stores historical trends and behavioral baselines for various metrics, such asCPU usage, network activity, and authentication patterns.

●Profile databasemaintainslong-term aggregated statisticsfor anomaly detection.

●Baseline valuesare used to comparecurrent eventsagainst expected behavior.

● This helps indetecting deviations, such as a sudden increase in failed logins or unusual traffic spikes.

The rule groups events by Reporting IP, Reporting Device, and User. Let's analyze the five events:

Events Received:

1. Reporting IP: 1.1.1.1, Reporting Device: Server101, User: John

2. Reporting IP: 1.1.1.1, Reporting Device: Server101, User: Craig

3. Reporting IP: 1.1.1.2, Reporting Device: Server109, User: Mary

4. Reporting IP: 1.1.1.1, Reporting Device: Server101, User: Craig (Duplicate of #2)

5. Reporting IP: 1.1.1.1, Reporting Device: Server101, User: John (Duplicate of #1)

Grouping Based on:

● Reporting IP

● Reporting Device

● User

Count unique groups:

1. (1.1.1.1, Server101, John) → 2 occurrences (counted as one group)

2. (1.1.1.1, Server101, Craig) → 2 occurrences (counted as one group)

3. (1.1.1.2, Server109, Mary) → 1 occurrence (counted as one group)

Since we need at least one matching event (count >= 1) per group, incidents are created for each unique group.

Total unique groups (incidents created) = 2

● John on Server101 (1.1.1.1)

● Craig on Server101 (1.1.1.1)

Thelicense filelocated at/etc/opsd/.fortisiem4x0is critical for thecollector's operation, as it verifies the collector'sregistration with the supervisorand enables proper functionality.

If thislicense file is removed, the collector:

● Willlose its registrationwith the supervisor.

● Willstop receiving updates and configurationsfrom the FortiSIEM supervisor.

● Will requirere-registrationwith the supervisor to obtain a new license file.

TheLookupTableHasfunction is used tocheck whether a specified key exists in a lookup table. It returnseither true or false, depending on whether the key is found in the table.

● If the key is present, the function returnstrue.

● If the key is absent, the function returnsfalse.

Thenatural_idvalue in theph_sys_connectortable of theFortiSIEM Postgres databaseuniquely identifies acollector.

● The SQL query retrieves details fromph_sys_connector, which stores information about registered collectors.

● Thecust_org_idfield indicates theorganization IDthe collector belongs to.

● Thenamefield shows thecollector's name(OrgA_Collector).

● Theip_addrfield lists thecollector's IP address(10.10.2.91).

● Thenatural_idvalue uniquelyidentifies the collector in the system.

FortiSIEM's rule engine queries the profile database to analyze historical behavior and detect anomalies. The profile database stores statistical baselines, which include:

● Statistical average (mean values over time)

● Standard deviation (variability from the mean)

These values help the rule engine determine whether an observed metric (such as logins, failed attempts, network traffic, or system performance) deviates significantly from the normal pattern for the same hour of the day.

The administratordeployed FortiSIEM without a collector, meaning there is no dedicated system collecting logs fromservice provider infrastructure devices. Without a collector, the FortiSIEMsupervisor and workersmust directly ingest logs, which is not ideal for amulti-tenant service provider setup. Acollector is necessaryto efficiently gather logs before forwarding them to the FortiSIEM cluster.

Group By automatically applies a COUNT aggregation.

When using Group By in FortiSIEM structured queries, it automatically applies a COUNT(*) function unless a different aggregation (such as SUM, AVG, or MAX) is specified. This helps summarize data by counting occurrences of grouped attributes.

Group By is applied to real-time and historical searches.

Grouping functions work in both real-time (live event monitoring) and historical (past event analysis) searches, making it useful for trend analysis, anomaly detection, and correlation.

phRuleWorker processes events in 60-second intervals (buckets). This means that events within a one-minute window are evaluated together for rule conditions, helping detect patterns, correlations, and triggers.

phRuleWorker runs both on the supervisor and worker nodes to distribute event processing. The supervisor primarily orchestrates rule evaluation, while workers handle distributed event processing.

The Z-score formula in the expression builder calculates how many standard deviations the current value is from the historical average. The formula used is:

AVG(Firewall Session)represents the current firewall session rate.

STAT_AVG(AVG(Firewall Session);112)represents the historical average over a 112-time unit window.

STAT_STDDEV(AVG(Firewall Session);112)represents the historical standard deviation over the same period.

AZ-score ≥ 3indicates that the current firewall session rate issignificantly higherthan the historical average (3 standard deviations above the mean), signaling ananomaly.

In aFortiSIEM deployment,device discoveryis handled by theSupervisor, even when aCollectoris present.

● TheSupervisor initiates active scansusing protocols such asSNMP, WMI, SSH, and API queriesto discover devices in the network.

●Collectors do not perform discovery; they primarilycollect and forward logsfrom designated devices to the Supervisor.

●Workers handle event processing, not discovery.