nerdexam
Fortinet

FCSS_ADA_AR-6.7 · Question #56

Refer to the exhibit. If the Z-score for this rule is greater than or equal to three, what does this mean?

The correct answer is C. The rate firewall connection is above the historical average value. The Z-score formula in the expression builder calculates how many standard deviations the current value is from the historical average. The formula used is: AVG(Firewall Session) represents the current firewall session rate. STAT_AVG(AVG(Firewall Session);112) represents the…

Advanced FortiSIEM Analytics

Question

Refer to the exhibit. If the Z-score for this rule is greater than or equal to three, what does this mean?

Exhibit

FCSS_ADA_AR-6.7 question #56 exhibit

Options

  • AThe rate of firewall connection is below historical average value.
  • BThe rate of firewall connection is optimum.
  • CThe rate firewall connection is above the historical average value.
  • DThe rate of firewall connection is above the current average value.

How the community answered

(38 responses)
  • A
    3% (1)
  • B
    5% (2)
  • C
    82% (31)
  • D
    11% (4)

Explanation

The Z-score formula in the expression builder calculates how many standard deviations the current value is from the historical average. The formula used is: AVG(Firewall Session) represents the current firewall session rate. STAT_AVG(AVG(Firewall Session);112) represents the historical average over a 112-time unit STAT_STDDEV(AVG(Firewall Session);112) represents the historical standard deviation over the A Z-score 3 indicates that the current firewall session rate is significantly higher than the historical average (3 standard deviations above the mean), signaling an anomaly.

Topics

#Z-score#statistical analysis#baseline anomaly detection#rule conditions

Community Discussion

No community discussion yet for this question.

Full FCSS_ADA_AR-6.7 Practice