Fortinet Exam FCSS_ADA_AR-6.7 Topic 1 Question 1 Discussion

Actual exam question for Fortinet's FCSS_ADA_AR-6.7 exam

Question #: 1
Topic #: 1

Refer to the exhibit.

An administrator runs an analytic search for all FortiGate SSL VPN logon failures. The results are grouped by source IP, reporting IP, and user. The administrator wants to restrict the results to only those rows where the COUNT >=3.

Which user would meet that condition?

AJan

BSarah

CAdmin

DTom
The administrator is running an analytic search that groups results by Source IP, Reporting IP, and User, and filters only those with a COUNT >= 3.
Looking at the data:
Admin has three failed attempts from the same Source IP (203.0.113.4) and Reporting IP (10.0.1.99).
Jan and Sarah appear only once or twice in the dataset.
Tom has multiple entries, but they are from different Source IPs and Reporting IPs, meaning they are not counted as three under the same group.

Show Suggested Answer

Suggested Answer: C

by Roxanne at Apr 03, 2025, 12:06 PM

Limited Time Offer

25%

Off

Get Premium FCSS_ADA_AR-6.7 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Skye

1 months ago

I'm going with B. Franklyn. It just makes the most sense based on the information provided in the question and the data shown in the exhibit.

upvoted 0 times

Jesus

12 days ago

Sarah is the only user with multiple failed logon attempts from the same Source IP and Reporting IP, so B) Sarah is the correct answer.

upvoted 0 times

...

Marguerita

15 days ago

Yes, you're right. Sarah is the user that meets the condition of having COUNT >= 3 in the dataset.

upvoted 0 times

...

Shelton

18 days ago

I think you meant B) Sarah, not B) Franklyn. But yes, Sarah is the correct choice based on the data.

upvoted 0 times

...

Rashad

1 months ago

Haha, of course the Rashad account is the one with the most failed login attempts. I guess they need to work on their password hygiene.

upvoted 0 times

Mica

16 days ago

I wonder if Admin is aware of the failed login attempts.

upvoted 0 times

...

Fallon

23 days ago

Yeah, they should definitely work on their password hygiene.

upvoted 0 times

...

Herminia

1 months ago

Admin really needs to update their password, three failed attempts is not a good sign.

upvoted 0 times

...

Kathryn

2 months ago

I see, so the key is to look for multiple failed attempts from the same Source IP and Reporting IP. Thanks for the explanation!

upvoted 0 times

...

Stephaine

2 months ago

I'm not sure about this one. The question mentions that the results are grouped, but it's not clear to me how that affects the count. Is there something I'm missing?

upvoted 0 times

Melissa

30 days ago

Tom has multiple entries, but they are not counted as three under the same group.

upvoted 0 times

...

Jennie

1 months ago

Jan and Sarah don't have three failed attempts in the same group.

upvoted 0 times

...

Sean

1 months ago

Admin would meet the condition because there are three failed attempts from the same Source IP and Reporting IP.

upvoted 0 times

...

Barrie

2 months ago

I agree with you, Bulah. Admin is the only one who meets the condition of having a COUNT >= 3 in the dataset.

upvoted 0 times

...

Franklyn

2 months ago

Hmm, I think the correct answer is B. Franklyn, since the question says the results are grouped by Source IP, Reporting IP, and User, and the count must be >= 3. From the data, it looks like Admin is the only one who meets that condition.

upvoted 0 times