Fortinet FCSS Advanced Analytics 6.7 Architect Practice Test

Skills this practice test covers

• Design a multi-tenant FortiSIEM deployment for an MSSP, with and without collectors.
• Manage EPS assignment and restrictions across FortiSIEM collectors and organizations.
• Build single and multiple subpattern rules with actions and clear conditions.
• Search FortiSIEM data with nested queries and lookup tables.
• Create baseline profiles and baseline rules, and deploy FortiSIEM UEBA agents.
• Remediate incidents with FortiSIEM scripts and with FortiSOAR playbooks.

4 domains · 21 topics · 200 of 208 questions sorted by domain

Requirements

• Required: an understanding of the FCP - FortiGate Security, FCP - FortiGate Infrastructure and FCP - FortiSIEM course content, or equivalent experience.
• Recommended: three years in networking, one year in network security and one year in a SOC or MSSP environment.
• Recommended: hands-on work deploying, integrating and troubleshooting FortiSIEM and FortiSOAR.
• Recommended: Python programming, Jinja2 templating, Linux systems and SOAR technologies.

About the FCSS-ADA-AR-6-7 exam

How to earn the certification

Earns

Fortinet Certified Solution Specialist (FCSS) - Security OperationsSolution Specialist

The FCSS certification stays valid for two years.

Before

• NSE5-FSM-6-3 Fortinet NSE 5 - FortiSIEM 6.3

  A FortiSIEM 6.3 exam. This architect exam lists FortiSIEM 6.3 as its product version and expects FortiSIEM knowledge first.

How to prepare for FCSS-ADA-AR-6-7

1. 1

   Set up two organizations in a lab

   Use the hands-on labs of the Advanced Analytics course, or a test FortiSIEM, with two organizations, one collector, one Windows agent and one Linux agent. Multi-Tenancy SOC Solution for MSSP has the most questions in the practice test, and most of them assume this layout.

2. 2

   Trace one incident from event to rule

   Pick a security event, follow it through rule processing, and write a single subpattern rule and a multiple subpattern rule that catch it. Add a clear condition and check when the incident clears.

3. 3

   Write nested queries against lookups

   Write a nested query whose inner search feeds the outer one, then match the results against a lookup table. Note how long each query takes on a busy organization.

4. 4

   Compare a baseline rule with UEBA

   Create a baseline profile, build a baseline rule on it, and compare its alerts with a log-based UEBA rule. Note which approach suits a known metric and which suits unusual user behavior.

5. 5

   Remediate twice, then run it timed

   Fix one incident with a FortiSIEM remediation script and the same incident with a FortiSOAR playbook. Then take the FCSS-ADA-AR-6-7 practice test in Timed Mode and ask Brainy AI Assistant about each missed rule or remediation case.

   Start a timed FCSS-ADA-AR-6-7run

Fortinet's exam description recommends the FCSS - Advanced Analytics 6.7, FCP - FortiSIEM 6.3 and FortiSIEM Parser 6.3 courses with their hands-on labs, plus the FortiSIEM 6.7 User Guide and the FortiSOAR 7.3 Administration Guide.

Who FCSS-ADA-AR-6-7 is for

• SOC engineers who design FortiSIEM rules, baselines and remediation for an enterprise.
• MSSP engineers and architects who run one FortiSIEM deployment for many customers.
• FortiSIEM and FortiSOAR administrators who connect the two products for automated response.
• Security architects who plan multi-tenant monitoring for a service provider.

Typical job titles: SOC engineer · SIEM architect · MSSP security engineer · Security operations manager · FortiSIEM administrator · Threat detection engineer

FCSS-ADA-AR-6-7 glossary

18 terms from the exam objectives and the vendor's official material, each defined in a sentence.

Baseline profiles

Records of the normal values of a metric over time, such as logins per hour, that baseline rules compare new data against.

Clear conditions

Rule settings that tell FortiSIEM when the cause of an incident has ended, so the incident can be cleared.

EPS (Events Per Second)

The rate of incoming events, which FortiSIEM administrators assign and restrict across collectors and organizations.

FortiSIEM

Fortinet's security information and event management (SIEM) system, which collects events, correlates them with rules and raises incidents.

FortiSIEM Collectors

FortiSIEM components placed near the monitored devices, which gather their logs and forward them to the central FortiSIEM cluster.

FortiSIEM Windows Agent

Software on a Windows host that sends its logs and other monitoring data to FortiSIEM.

FortiSOAR

Fortinet's security orchestration, automation and response platform, which runs playbooks to investigate and fix incidents.

FortiSOAR Connectors

Integrations that let FortiSOAR exchange data with, and run actions on, other products such as FortiSIEM.

Jinja2

A template language for Python that FortiSOAR playbooks use to read and transform data.

Lookup tables

Tables of reference values, such as a watch list of addresses, that FortiSIEM queries and rules can match events against.

MSSP

Managed security service provider: a company that monitors and protects the networks of many customer organizations.

Multi-tenancy

Running one FortiSIEM deployment for several separate organizations while keeping each organization's data and settings apart.

Multiple subpattern rules

FortiSIEM rules that join two or more event patterns with conditions, such as a scan followed by a login from the same address.

Nested queries

Searches that run inside another search, where the result of the inner query filters the outer one.

Out-of-the-box remediation scripts

Ready-made FortiSIEM scripts that take an action on a device when an incident needs a response.

Playbooks

FortiSOAR workflows of steps that run on a trigger or on request to investigate or remediate an incident.

Single subpattern security rules

FortiSIEM rules that match one pattern of events, such as repeated failed logins from one source within a time window.

User and Entity Behavior Analytics (UEBA)

Analytics that learn how each user and device normally behaves and flag activity that departs from that pattern.