NSE6_FSM_AN-7.4 by Fortinet Actual Free Exam Questions And Answers

Question 1

From which two sources can you import data to train FortiSIEM machine learning? (Choose two.)

A. SQL database

B. Syslog archives

C. CSV files

D. FortiSIEM reports

Discussion 0

Correct Answer: C,D Vote an answer

Question 2

Refer to the exhibit. Which event type attribute value will the FortiSIEM parser save for this event?

A. sysUpTime

B. PHL_INFO

C. phLogDetail

D. PH_DEV_MON_SYS_UPTIME

Discussion 0

Correct Answer: D Vote an answer

Explanation: Only visible for Fast2test members. You can sign-up / login (it's free).

Question 3

Several new internal servers are generating incidents and must be excluded from several FortiSIEM rules. How must you tune rules to exclude several undiscovered devices from rules?

A. Add them to the global exclusion list.

B. Add their associated discovery credentials.

C. Add them to a device group that is being filtered by the rules.

D. Add the devices to a rule exclusion automation policy.

Discussion 0

Correct Answer: C Vote an answer

Explanation: Only visible for Fast2test members. You can sign-up / login (it's free).

Question 4

Rules on FortiSIEM are usually processed as events are collected (streaming). How can you create a rule to evaluate events over an 8-hour period?

A. Configure a 28,000-second time window under the Define Conditions tab.

B. Configure a report to run the analytical query and run the report every 8 hours.

C. Configure a crontabprocess on the FortiSIEM supervisor.

D. Set the Evaluation Mode to Scheduled under the General tab.

Discussion 0

Correct Answer: D Vote an answer

Explanation: Only visible for Fast2test members. You can sign-up / login (it's free).

Question 5

Refer to the exhibit.

Which value would you expect the FortiSIEM parser to use to populate the Application Name field?

A. applist

B. wan1

C. Network.Service

D. SSL

Discussion 0

Correct Answer: D Vote an answer

Explanation: Only visible for Fast2test members. You can sign-up / login (it's free).

Question 6

An analyst wants to create a rule from a newly created analytics search. What is the quickest method?

A. Create a new rule under Resources > Rules and fill in the search details.

B. On the Analytics tab, click Actions > Create Rule.

C. On the Analytics tab, click the New button next to the Filter By box.

D. On the upper menu bar on any tab, click the pencil icon.

Discussion 0

Correct Answer: B Vote an answer

Explanation: Only visible for Fast2test members. You can sign-up / login (it's free).

Question 7

You want to reference the first source IP address from an incident in a playbook. Which option shows the correct Jinja syntax for using a variable for the source IP address in a FortiSIEM playbook?

A. srcIpAddr(1)

B. srcIpAddr.records[0]

C. record(srcIpAddr)

D. vars.input.records[0].srcIpAddr

Discussion 0

Correct Answer: D Vote an answer

Explanation: Only visible for Fast2test members. You can sign-up / login (it's free).

Question 8

Refer to the exhibit.

Which statement about the nested query shown in the exhibit is true?

A. The outer query could have also referenced the Protocol field from the inner query.

B. The outer query should have used the operator CONTAINS when referencing the inner query.

C. The outer query could have also referenced the Reporting IP address field from the inner query.

D. The outer query could have referenced all the queried fields from the inner query.

Discussion 0

Correct Answer: C Vote an answer

Explanation: Only visible for Fast2test members. You can sign-up / login (it's free).

Question 9

Refer to the exhibit. Which two things that happen when this automation policy triggers? (Choose two.)

A. A remediation script is run.

B. No notification or remediation is performed.

C. An email is sent to the defined email.

D. A clear notification is sent to the SOC manager dashboard.

Discussion 0

Correct Answer: A,C Vote an answer

Explanation: Only visible for Fast2test members. You can sign-up / login (it's free).

Question 10

Which two attributes can you not select together in the Group By and Display Fields? (Choose two.)

A. Event Reporting Time

B. Source IP

C. Reporting IP

D. Destination IP

E. Raw Event Log

Discussion 0

Correct Answer: D,E Vote an answer

Fortinet NSE 6 - FortiSIEM 7.4 Analyst - NSE6_FSM_AN-7.4 Exam Practice Test

Contact Us

Useful Links

Latest Updated