Fortinet NSE 6 - FortiSIEM 7.4 Analyst - NSE6_FSM

Question 1

Refer to the exhibit. What does the Group: Windows value refer to?

A. A configuration management database (CMDB) device group

B. A FortiSIEM user group

C. A SOC analyst group

D. A Windows Active Directory (AD) user group

Correct Answer: A

Explanation: Only visible for Actualtests4sure members. You can sign-up / login (it's free).

Question 2

Refer to the exhibit. If you group the events by Reporting IP, Event Type, and User attributes, how many results will FortiSIEM display?

A. Five

B. Four

C. Three

D. Two

Correct Answer: C

Explanation: Only visible for Actualtests4sure members. You can sign-up / login (it's free).

Question 3

Refer to the exhibit.

If you group these events by the User and Count attributes, how many unique results will FortiSIEM display?

A. Five

B. Four

C. Three

D. Six

Correct Answer: A

Explanation: Only visible for Actualtests4sure members. You can sign-up / login (it's free).

Question 4

Refer to the exhibit. Which value will the FortiSIEM parser use to populate the Application Name field?

A. Network Service

B. Network.Service: SSL

C. SSL

D. Network.Service

Correct Answer: C

Explanation: Only visible for Actualtests4sure members. You can sign-up / login (it's free).

Question 5

When selecting multiple rules at once on FortiSIEM, which actions can you perform?

A. You can only activate or deactivate multiple rules at a time.

B. You can view, edit, or activate only one rule at a time

C. You can change the severity, activate, or deactivate multiple rules at a time.

D. You can only change the severity of multiple rules at a time.

Correct Answer: C

Explanation: Only visible for Actualtests4sure members. You can sign-up / login (it's free).

Question 6

What are four incident status options on FortiSIEM?

A. Active, auto cleared, cleared manually, system cleared

B. Active, closed, cleared, resolved

C. Active, cleared, false negative, false positive

D. Active, auto closed, closed manually, system closed

Correct Answer: B

Explanation: Only visible for Actualtests4sure members. You can sign-up / login (it's free).

Question 7

Refer to the exhibit.

You are investigating an issue with two destination IP addresses, but you are not getting any results from the search.
Based on the filters shown in the exhibit, why is this search returning no results?

A. You are using the wrong Boolean operator in the Next column.

B. The two items are not grouped in parentheses ().

C. You are using an invalid IP address in the Value column.

D. You are using an incorrect entry in the Operator column.

Correct Answer: A

Explanation: Only visible for Actualtests4sure members. You can sign-up / login (it's free).

Question 8

An analyst wants to create a rule from a new analytic search they just performed. Which method is the most efficient way for you to create the rule?

A. Make a new rule using the Create Rule option in the Actions menu.

B. Copy and paste the raw analytics search text into a rule subpattern.

C. Manually re-create the analytics search in the rule configuration.

D. Save the search as a template, and create a new rule from the template.

Correct Answer: A

Explanation: Only visible for Actualtests4sure members. You can sign-up / login (it's free).

Question 9

Which two data areas can you use for user and entity behavior analytics (UEBA) machine learning models? (Choose two.)

A. location

B. network

C. resources

D. process

Correct Answer: A,B

Explanation: Only visible for Actualtests4sure members. You can sign-up / login (it's free).

Question 10

Which two ways are rule tags used on FortiSIEM? (Choose two.)

A. Playbook filtering

B. Event searches

C. Zero trust network access (ZTNA) enforcement on FortiClient EMS

D. Administrative user permissions

Correct Answer: A,B

Explanation: Only visible for Actualtests4sure members. You can sign-up / login (it's free).

Fortinet NSE 6 - FortiSIEM 7.4 Analyst - NSE6_FSM_AN-7.4 Exam Practice Test

Latest Update

Useful Links

Contact Us