Consider the storage of anomaly baseline date that is calculated for different parameters.
Which database is used for storing this data?

1. A. Event DB
2. B. Profile DB
3. C. SVN DB
4. D. CMDB

Correct Answer: B
Anomaly Baseline Data: Anomaly baseline data refers to the statistical profiles and baselines calculated for various parameters to detect deviations indicative of potential security incidents.
Profile DB: The Profile DB is specifically designed to store such baseline data in FortiSIEM.
Purpose: It maintains statistical profiles for different monitored parameters to facilitate anomaly detection.
Usage: This data is used by FortiSIEM to compare real-time metrics against the established baselines to identify anomalies.
References: FortiSIEM 6.3 User Guide, Database Architecture section, which describes the different databases used in FortiSIEM and their purposes, including the Profile DB for storing anomaly baseline data.

In the rules engine, which condition instructs FortiSIEM to summarize and count the matching evaluated data?

1. A. Time Window
2. B. Aggregation
3. C. Group By
4. D. Filters

Correct Answer: B
Rules Engine in FortiSIEM: The rules engine evaluates incoming events based on defined conditions to detect incidents and anomalies.
Aggregation Condition: The aggregation condition instructs FortiSIEM to summarize and count the matching evaluated data.
Function: Aggregation is used to group events based on specified criteria and then perform operations such as counting the number of occurrences within a defined time window.
Purpose: This allows for the detection of patterns and anomalies, such as a high number of failed login attempts within a short period.
References: FortiSIEM 6.3 User Guide, Rules Engine section, which explains how aggregation is used to summarize and count matching data.

IF the reported packet loss is between 50% and 98%. which status is assigned to the device in the Availability column of summary dashboard?

1. A. Up status is assigned because of received packets.
2. B. Critical status is assigned because of reduction in number of packets received.
3. C. Degraded status is assigned because of packet loss
4. D. Down status is assigned because of packet loss.

Correct Answer: C
Device Status in FortiSIEM: FortiSIEM assigns different statuses to devices based on their operational state and performance metrics.
Packet Loss Impact: The reported packet loss percentage directly influences the status assigned to a device. Packet loss between 50% and 98% indicates significant network issues that affect the device's performance.
Degraded Status: When packet loss is between 50% and 98%, FortiSIEM assigns a "Degraded" status to the device. This status indicates that the device is experiencing substantial packet loss, which impairs its performance but does not render it completely non-functional.
Reasoning: The "Degraded" status helps administrators identify devices with serious performance issues that need attention but are not entirely down.
References: FortiSIEM 6.3 User Guide, Device Availability and Status section, explains the criteria for assigning different statuses based on performance metrics such as packet loss.

What are the four possible incident status values?

1. A. Active, dosed, cleared, open
2. B. Active, cleared, cleared manually, system cleared
3. C. Active, closed, manual, resolved
4. D. Active, auto cleared, manual, false positive

Correct Answer: C

What are the four categories of incidents?

1. A. Devices, users, high risk, and low risk
2. B. Performance, devices, high risk, and low risk
3. C. Performance, availability, security, and change
4. D. Security, change, high risk, and low risk

Correct Answer: C
Explanation
Incident Categories in FortiSIEM: Incidents in FortiSIEM are categorized to help administrators quickly identify and prioritize the type of issue.
Four Main Categories:
Performance: Incidents related to the performance of devices and applications, such as high CPU usage or memory utilization.
Availability: Incidents affecting the availability of services or devices, such as downtime or connectivity issues.
Security: Incidents related to security events, such as failed login attempts, malware detection, or unauthorized access.
Change: Incidents triggered by changes in the configuration or state of devices, such as new software installations or configuration modifications.
Importance of Categorization: These categories help in the efficient management and response to different types of incidents, allowing for better resource allocation and quicker resolution.
References: FortiSIEM 6.3 User Guide, Incident Management section, which details the different categories of incidents and their significance.