Fortinet Exam FCSS_ADA_AR-6.7 Topic 1 Question 1 Discussion

Actual exam question for Fortinet's FCSS_ADA_AR-6.7 exam

Question #: 1
Topic #: 1

Refer to the exhibit.

An administrator runs an analytic search for all FortiGate SSL VPN logon failures. The results are grouped by source IP, reporting IP, and user. The administrator wants to restrict the results to only those rows where the COUNT >=3.

Which user would meet that condition?

AJan

BSarah

CAdmin

DTom
The administrator is running an analytic search that groups results by Source IP, Reporting IP, and User, and filters only those with a COUNT >= 3.
Looking at the data:
Admin has three failed attempts from the same Source IP (203.0.113.4) and Reporting IP (10.0.1.99).
Jan and Sarah appear only once or twice in the dataset.
Tom has multiple entries, but they are from different Source IPs and Reporting IPs, meaning they are not counted as three under the same group.

Show Suggested Answer

Suggested Answer: C

by Roxanne at Apr 03, 2025, 12:06 PM

Limited Time Offer

25%

Off

Get Premium FCSS_ADA_AR-6.7 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Skye

24 days ago

I'm going with B. Franklyn. It just makes the most sense based on the information provided in the question and the data shown in the exhibit.

upvoted 0 times

Marguerita

14 hours ago

Yes, you're right. Sarah is the user that meets the condition of having COUNT >= 3 in the dataset.

upvoted 0 times

...

Shelton

4 days ago

I think you meant B) Sarah, not B) Franklyn. But yes, Sarah is the correct choice based on the data.

upvoted 0 times

...

Rashad

28 days ago

Haha, of course the Rashad account is the one with the most failed login attempts. I guess they need to work on their password hygiene.

upvoted 0 times

Mica

2 days ago

I wonder if Admin is aware of the failed login attempts.

upvoted 0 times

...

Fallon

9 days ago

Yeah, they should definitely work on their password hygiene.

upvoted 0 times

...

Herminia

21 days ago

Admin really needs to update their password, three failed attempts is not a good sign.

upvoted 0 times

...

Kathryn

1 months ago

I see, so the key is to look for multiple failed attempts from the same Source IP and Reporting IP. Thanks for the explanation!

upvoted 0 times

...

Stephaine

1 months ago

I'm not sure about this one. The question mentions that the results are grouped, but it's not clear to me how that affects the count. Is there something I'm missing?

upvoted 0 times

Melissa

16 days ago

Tom has multiple entries, but they are not counted as three under the same group.

upvoted 0 times

...

Jennie

20 days ago

Jan and Sarah don't have three failed attempts in the same group.

upvoted 0 times

...

Sean

27 days ago

Admin would meet the condition because there are three failed attempts from the same Source IP and Reporting IP.

upvoted 0 times

...

Barrie

1 months ago

I agree with you, Bulah. Admin is the only one who meets the condition of having a COUNT >= 3 in the dataset.

upvoted 0 times

...

Franklyn

1 months ago

Hmm, I think the correct answer is B. Franklyn, since the question says the results are grouped by Source IP, Reporting IP, and User, and the count must be >= 3. From the data, it looks like Admin is the only one who meets that condition.

upvoted 0 times