nerdexam
Fortinet

FCSS_ADA_AR-6.7 · Question #50

Refer to the exhibit. Consider a nested event query where both inner and outer queries are event queries. Reporting IP is selected from the CMDB group Network Device, Event Type is selected from the…

The correct answer is C. The nested time range will be configured for the Source IP attribute. In a nested event query, the inner query executes first, and its results feed into the outer query. Since the Source IP comes from the report "Failed Logons to Network Devices", which is part of the inner query, the nested time range applies to it. The other attributes…

Advanced FortiSIEM Analytics

Question

Refer to the exhibit. Consider a nested event query where both inner and outer queries are event queries. Reporting IP is selected from the CMDB group Network Device, Event Type is selected from the CMDB group Logon Success, and Source IP is selected from the report Failed Logons to Network Devices. An administrator is about to execute the nested query. The report time ranges must be set before execution. The Nested Time Range will be applied to which attributes?

Exhibit

FCSS_ADA_AR-6.7 question #50 exhibit

Options

  • AThe nested time range will be configured for the Reporting IP attribute.
  • BThe nested time range will be configured for the Reporting IP and Event Type attributes.
  • CThe nested time range will be configured for the Source IP attribute.
  • DThe nested time range will be configured for the Event Type attribute.

How the community answered

(23 responses)
  • A
    17% (4)
  • B
    9% (2)
  • C
    43% (10)
  • D
    30% (7)

Explanation

In a nested event query, the inner query executes first, and its results feed into the outer query. Since the Source IP comes from the report "Failed Logons to Network Devices", which is part of the inner query, the nested time range applies to it. The other attributes, Reporting IP and Event Type, belong to the outer query and are not affected by the nested time range.

Topics

#nested queries#time range#CMDB groups#query configuration

Community Discussion

No community discussion yet for this question.

Full FCSS_ADA_AR-6.7 Practice