[2026年04月] 検証済みFortinet試験問題集でFCSS_ADA_AR-6.7試験学習ガイド
ベスト品質のFortinet FCSS_ADA_AR-6.7試験解答リアル練習試験問題集で[2026]
Fortinet FCSS_ADA_AR-6.7 認定試験の出題範囲：
| トピック | 出題範囲 |
|---|---|
| トピック 1 |
|
| トピック 2 |
|
| トピック 3 |
|
| トピック 4 |
|
質問 # 22
Refer to the exhibit.
Which scenario is not a supported nested query scenario?
- A. The outer query is the event query, and the inner query is the CMDB query.
- B. The outer query is the event query, and the inner query is the event query.
- C. The outer query is the CMDB query, and the inner query is the event query.
- D. The outer query is the CMDB query, and the inner query is the CMDB query.
正解：D
解説：
FortiSIEM does not allow CMDB queries to be nested within other CMDB queries. CMDB data is static information, and nesting would not add value or function properly in query execution.
質問 # 23
Which syntax will register a collector to the supervisor?
- A. phProvisionCollector -add <user><password><super IP><organization><workerName>
- B. phProvisionCollector -add <user><password><collector IP><organization><superName>
- C. phProvisionCollector -add <user><password><super ID><organization><collectorName>
- D. phProvisionCollector -add <user><password><collector IP><organizationid><collectorName>
正解：A
解説：
The phProvisionCollector command is used to register a collector to the supervisor in FortiSIEM. The correct syntax requires:
# User # The admin username for authentication.
# Password # The password for authentication.
# Super IP # The IP address of the supervisor, which manages the collector.
# Organization # The organization to which the collector belongs.
# Worker Name # The name of the worker node responsible for handling events from this collector.
質問 # 24
Which three statements about collector communication with the FortiSIEM cluster are true? (Choose three.)
- A. Collectors communicate periodically with the supervisor node.
- B. The supervisor does not initiate any connections to the collector node.
- C. The supervisor periodically checks the health of the collector.
- D. Collectors upload event data to any node in the worker upload list, but report their health directly to the supervisor node.
- E. The only communication between the collector and the supervisor is during the registration process.
正解：A、B、D
質問 # 25
In the context of FortiSIEM, why is establishing a proper baseline essential?
- A. It provides a platform for users to request access permissions?
- B. It facilitates smoother communication between different network segments?
- C. It allows administrators to set their preferred themes?
- D. It offers an operational standard against which deviations can be flagged?
正解：D
質問 # 26
Which three statements about collector communication with the FortiSIEM cluster are true? (Choose three.)
- A. Collectors communicate periodically with the supervisor node.
- B. Collector upload event data to any node in the worker upload list, but report their health directly to the supervisor node.
- C. The supervisor periodically checks the health of the collector.
- D. The supervisor does not initiate any connections to the collector node.
- E. The only communication between the collector and the supervisor is during the registration process.
正解：A、B、C
解説：
FortiSIEMcollectorsare responsible forgathering logsfrom devices andforwarding themto the FortiSIEM cluster. Their communication with the cluster follows these key principles:
#Collectors periodically communicate with the supervisor node.
# This allows them toreport status, receive updates, and verify configurations.
#The supervisor periodically checks the health of the collector.
# Thesupervisor monitors the collector's uptime, connectivity, and performance.
#Collectors upload event data to worker nodes but report health to the supervisor.
#Event logs are uploaded to worker nodesas per theworker upload list, ensuring distributed event processing.
#Health status is always reported directly to the supervisorfor centralized monitoring.
質問 # 27
When automating remediation in FortiSIEM, what should be carefully considered?
- A. The number of users currently logged in?
- B. The potential impact of the automated action on business operations?
- C. The aesthetic layout of the FortiSIEM dashboard?
- D. The frequency of software updates?
正解：B
質問 # 28
Why can collectorsnotbe defined before the worker upload address is set on the supervisor?
- A. To ensure that the service provider has deployed a NFS server
- B. To ensure that the service provider has deployed at least one worker along with a supervisor
- C. Collectors can only upload data to a worker, and the supervisor is not a worker
- D. Collectors receive the worker upload address during the registration process
正解：D
解説：
In FortiSIEM, collectors must know where to upload event data. During registration, the supervisor provides the collector with the worker upload address.
The worker upload address tells the collector where to send logs after collection. If no worker upload address is set, the collector has no destination for its data, preventing proper registration.
質問 # 29
From where does the rule engine load the baseline data values?
- A. The profile report
- B. The memory
- C. The profile database
- D. The daily database
正解：C
解説：
Therule engineinFortiSIEMloadsbaseline data valuesfrom theprofile database. This database stores historical trends and behavioral baselines for various metrics, such asCPU usage, network activity, and authentication patterns.
#Profile databasemaintainslong-term aggregated statisticsfor anomaly detection.
#Baseline valuesare used to comparecurrent eventsagainst expected behavior.
# This helps indetecting deviations, such as a sudden increase in failed logins or unusual traffic spikes.
質問 # 30
What is the disadvantage of automatic remediation?
- A. Threat behavior occurring during the night could take hours to respond to.
- B. External threats or attacks detected by FortiSIEM will need user interaction to take action on an already overworked SOC team.
- C. It can make a disruptive change to a user, block access to an application, or disconnect critical systems from the network.
- D. It is equivalent to running an IPS in monitor-only mode-watches but does not block.
正解：C
解説：
Automatic remediation inFortiSIEMenablesreal-time responseto security threats without manual intervention.
While this can improve response times, it also introducesrisksbecauseactions are taken automatically based on predefined rules, without human verification.
# Automated responsescould mistakenly block legitimate usersfrom critical systems or applications.
#Misconfigured rulesmightdisconnect essential systems, causing business disruptions.
# If an incident isa false positive,automatic remediation may interfere with normal operationsunnecessarily.
質問 # 31
Refer to the exhibit.
Which devices will be added to the CMDB and mapped to Customer E?
- A. 10.60.0.1
- B. 10.50.0.1
- C. 10.50.0.149
- D. 10.50.0.150
正解：B、C
解説：
From the exhibit, we can determine the IP range that will be added to the CMDB and mapped to Customer E.
# The included IP range is 10.50.0.1 - 10.50.0.50.
# This means any device within this range (10.50.0.1 to 10.50.0.50) will be added to the CMDB.
10.50.0.1 # Falls within the included range (10.50.0.1 - 10.50.0.50) # Added to CMDB.
10.50.0.149 # Falls within the 10.50.0.1 - 10.50.0.50 range # Added to CMDB.
質問 # 32
If a FortiSIEM rule is constructed to detect a potential data exfiltration attempt, which framework can provide insights on the techniques attackers might use for this purpose?
- A. ISO/IEC 27001?
- B. OWASP Top Ten?
- C. NIST SP 800-53?
- D. MITRE ATT&CK®?
正解：D
質問 # 33
Refer to the exhibit.
Is the Windows agent delivering event logs correctly?
- A. The logs are buffered by the agent and will be sent once the status changes to managed.
- B. The agent is registered and it is sending logs correctly.
- C. The agent is not sending logs because it did not receive a monitoring template.
- D. Because the agent is unmanaged. the logs are dropped silently by the supervisor.
正解：C
解説：
TheWindows agent (fortibank_dc.fortibank.net)is in an"Unmanaged"state, which indicates that it has not received amonitoring templatefrom FortiSIEM. Without a template, the agent does not know what logs to collect or forward, meaning it isnot sending logs to the supervisor.
Theagent is registered, meaning it has completed the installation and connection process. Since it isunmanaged, it isnot actively monitoredor configured to send logs. To resolve this, the administrator mustassign a monitoring templateto enable proper log forwarding.
質問 # 34
Why do collectors communicate with the Supervisor after registration? (Choose two.)
- A. To upload event data if a worker down
- B. To receive templates associated with agents
- C. To report the health status of the agents
- D. To report its own health status
正解：A、D
解説：
After registration, collectors maintain continuous communication with the Supervisor to ensure proper event processing, system health monitoring, and failover handling. The two key reasons collectors communicate with the Supervisor are:
1. To upload event data if a worker is down
2. To report its own health status
質問 # 35
Refer to the exhibit.
The rule evaluates multiple VPN logon failures within a ten-minute window. Consider the following VPN failure events received within a ten-minute window:
How many incidents are generated?
- A. 0
- B. 1
- C. 2
- D. 3
正解：B
解説：
The rule triggers an incident when there are two or more VPN logon failures within a 10-minute window, grouped by Source IP, Reporting Device, Reporting IP, and User. Let's analyze the events:
Breakdown of Events:
1. Reporting IP: 1.1.1.1, Source IP: 2.2.2.2, Device: FortiGate, User: Sarah
2. Reporting IP: 1.1.1.1, Source IP: 2.2.2.2, Device: FortiGate, User: John
3. Reporting IP: 1.1.1.3, Source IP: 2.2.2.2, Device: FortiGate2, User: Tom
4. Reporting IP: 1.1.1.3, Source IP: 2.2.2.2, Device: FortiGate2, User: John
5. Reporting IP: 1.1.1.3, Source IP: 2.2.2.2, Device: FortiGate2, User: Sarah
6. Reporting IP: 1.1.1.1, Source IP: 2.2.2.2, Device: FortiGate, User: Tom Now, applying the grouping criteria (Source IP, Reporting Device, Reporting IP, and User):
*Group 1: (1.1.1.1, 2.2.2.2, FortiGate, John) → 1 occurrence (not enough)
*Group 2: (1.1.1.1, 2.2.2.2, FortiGate, Sarah) → 1 occurrence (not enough)
*Group 3: (1.1.1.1, 2.2.2.2, FortiGate, Tom) → 2 occurrences (incident triggered)
*Group 4: (1.1.1.3, 2.2.2.2, FortiGate2, John) → 2 occurrences (incident triggered)
*Group 5: (1.1.1.3, 2.2.2.2, FortiGate2, Sarah) → 1 occurrence (not enough)
*Group 6: (1.1.1.3, 2.2.2.2, FortiGate2, Tom) → 1 occurrence (not enough) Final Incident Count:
*One incident for Group 3 (Tom on FortiGate)
*One incident for Group 4 (John on FortiGate2)
質問 # 36
What three key metrics does a UEBA agent capture? (Choose three.)
- A. Keystroke logging
- B. Process
- C. Location
- D. User
- E. Device
正解：B、D、E
質問 # 37
For what type of data values does the rule engine query the profile database?
- A. First and/or last values for the current hour of the day
- B. High and/or low values for the current hour of the day
- C. Minimum and/or maximum values for the current hour of the day
- D. Statistical average and/or standard deviation values for the current hour of the day
正解：D
解説：
FortiSIEM's rule engine queries the profile database to analyze historical behavior and detect anomalies. The profile database stores statistical baselines, which include:
# Statistical average (mean values over time)
# Standard deviation (variability from the mean)
These values help the rule engine determine whether an observed metric (such as logins, failed attempts, network traffic, or system performance) deviates significantly from the normal pattern for the same hour of the day.
質問 # 38
......
正真正銘のベスト材料FCSS_ADA_AR-6.7：https://www.jpntest.com/shiken/FCSS_ADA_AR-6.7-mondaishu
FCSS_ADA_AR-6.7テストエンジン練習試験：https://drive.google.com/open?id=15j1mgSt5BvrZur5-oj8nOUwDlCGJyO63