Free Practice Questions for the Fortinet Certified Professional Security Operations FCSS_ADA_AR-6.7 Exam (2026 Updated)

The LookupTableHas function is used to check whether a specified key exists in a lookup table . It returns either true or false , depending on whether the key is found in the table.

● If the key is present, the function returns true .

● If the key is absent, the function returns false .

From the provided XML configuration, we need to focus on the < GroupByAttr > section, which defines the attributes used for grouping.

In the SelectClause , the following attributes are listed:

reptDevName, reptDevAddr, COUNT(*), COUNT(DISTINCT user), COUNT(DISTINCT srcIpAddr)

● reptDevName represents the reporting device .

● reptDevAddr represents the reporting IP .

● COUNT(DISTINCT user) tracks unique users.

● COUNT(DISTINCT srcIpAddr) tracks distinct source IPs.

In the GroupByAttr section:

< GroupByAttr > reptDevName, reptDevAddr < /GroupByAttr >

This confirms that the grouping is performed by Reporting Device (reptDevName) and Reporting IP (reptDevAddr) .

When a WAN link failure occurs between the collector and the supervisor in FortiSIEM, the collector buffers event files until the connection is restored. By default:

● The collector can store up to 10,000 event files before reaching its buffer limit.

● Once the WAN link is restored, the collector uploads the stored event files to the supervisor for processing.

● If the buffer limit is exceeded , older event files may be overwritten to make space for new ones.

The exhibit shows a FortiSIEM cluster deployed in a multi-tenant service provider environment, serving multiple customers. The architecture includes:

1. Customers with Collectors

Customer A and Customer B (AWS) have collectors deployed within their environments.

Collectors gather and forward logs to the FortiSIEM cluster for centralized analysis.

2. Customers Without Collectors

Customer C does not have a collector; instead, it sends logs directly to the FortiSIEM cluster.

3. Super Organization Managing Infrastructure

The service provider infrastructure devices (e.g., networking and security appliances) are managed directly by the FortiSIEM cluster.

This mixed setup, where some customers use collectors while others send logs directly, represents a hybrid deployment with and without collectors.

When a FortiSIEM collector is deployed for the first time, most of its processes remain down until it is successfully registered with the supervisor.

The phMonitor process is running because it monitors system health, but other services remain inactive until the collector establishes communication with the supervisor.

Once the collector registers to the supervisor, it receives configurations and policies, and its processes will start automatically.

The natural_id value in the ph_sys_connector table of the FortiSIEM Postgres database uniquely identifies a collector .

● The SQL query retrieves details from ph_sys_connector , which stores information about registered collectors.

● The cust_org_id field indicates the organization ID the collector belongs to.

● The name field shows the collector ' s name ( OrgA_Collector ).

● The ip_addr field lists the collector ' s IP address ( 10.10.2.91 ).

● The natural_id value uniquely identifies the collector in the system .

The Z-score formula in the expression builder calculates how many standard deviations the current value is from the historical average. The formula used is:

AVG(Firewall Session) represents the current firewall session rate.

STAT_AVG(AVG(Firewall Session);112) represents the historical average over a 112-time unit window.

STAT_STDDEV(AVG(Firewall Session);112) represents the historical standard deviation over the same period.

A Z-score ≥ 3 indicates that the current firewall session rate is significantly higher than the historical average (3 standard deviations above the mean), signaling an anomaly .

These three processes are essential for a FortiSIEM collector , as they handle event parsing, agent communication, and system monitoring.

● phParser is responsible for parsing and processing collected logs before forwarding them.

● phAgentManager manages agent communication , ensuring logs are received and forwarded correctly.

● phMonitorAgent monitors the health of the collector itself , reporting system status to the FortiSIEM supervisor.

phReportMaster and phRuleMaster do not run on collectors. They are supervisor/worker processes handling reporting and rule evaluation, respectively.

From the exhibit, we can determine the IP range that will be added to the CMDB and mapped to Customer E.

● The included IP range is 10.50.0.1 – 10.50.0.50.

● This means any device within this range (10.50.0.1 to 10.50.0.50) will be added to the CMDB.

10.50.0.1 → Falls within the included range (10.50.0.1 – 10.50.0.50) → Added to CMDB.

10.50.0.149 → Falls within the 10.50.0.1 – 10.50.0.50 range → Added to CMDB.

When a User and Entity Behavior Analytics (UEBA) agent is off-net , meaning it is disconnected from the network and cannot reach the FortiSIEM collector, it temporarily stores (caches) events locally until it can re-establish a connection.

● This caching mechanism prevents data loss by ensuring events are retained even when the agent is offline.

● Once the connection to the FortiSIEM collector is restored , the agent uploads the cached events .

● This ensures continuity in user behavior monitoring , even when users are disconnected.

The exhibit shows the directory listings for three different workers ( worker1 , worker2 , and worker3 ) under the /querywkr/active/13127* path, which indicates active query tasks assigned to each worker.

1. Worker1 ( worker1 )

The output does not show any subdirectories or task files ( 13127t0 , 13127t1 , etc.), meaning Worker1 is not assigned any tasks .

2. Worker2 ( worker2 )

The output shows one task ( 13127t1 ) under /querywkr/active/13127* .

The worker has only one assigned task, not two , so options C and D are incorrect .

3. Worker3 ( worker3 )

The output shows two tasks ( 13127t0 and 13127t1 ) , indicating that Worker3 is processing two tasks for query ID 13127.

From the exhibit, the rule exception is set for:

● Time Range: Starts at 00:00:00

● Duration: 2 days

● Recurrence Pattern: December 25th and December 26th

This means that during these two days (every year in December), the rule will not trigger incidents.

Rule exceptions temporarily suppress incident generation during the specified period.

Events are still processed, but no incidents are generated.