NSE 7 – FortiADC 6.3 — Question 7
What happens to UEBA events when a user is off-net?
Answer options
- A. The agent will upload the events to the Worker if it cannot upload them to a FortiSIEM collector
- B. The agent will cache events locally if it cannot upload them to a FortiSIEM collector
- C. The agent will upload the events to the Supervisor if it cannot upload them to a FortiSIEM collector
- D. The agent will drop the events if it cannot upload them to a FortiSIEM collector
Correct answer: B
Explanation
The correct answer is B because the agent is designed to cache events locally when it fails to upload them to a FortiSIEM collector, ensuring no data is lost during off-net periods. Options A and C are incorrect as they mention uploading to the Worker and Supervisor, which does not occur when off-net. Option D is incorrect because events are not simply dropped; they are cached.