Fortinet NSE 6 - FortiSIEM 7.4 Analyst - NSE6_FSM_AN-7.4 Free Exam Questions

A. Active, closed, cleared, resolved

B. Active, auto cleared, cleared manually, system cleared

C. Active, cleared, false negative, false positive

D. Active, auto closed, closed manually, system closed

A. Assign the TTP category in the aggregate section of the rule subpattern.

B. Assign the TTP category to one of the incidents generated by the rule.

C. Add the rule directly in the Rule Coverage matrix under the appropriate TTP section.

D. Configure the appropriate TTP category in the Define Action section of the rule.

A. The Aggregate attribute is too restrictive.

B. The Destination Host Name value is not fully qualified.

C. The Group By attributes restricts which events are counted.

D. The Event Type refers to a CMDB lookup and should be an Event lookup.

A. Source IP

B. Raw Event Log

C. Reporting IP

D. Event Reporting Time

E. Destination IP

A. Associated source IP addresses will be blocked on all FortiGate firewalls.

B. Associated source IP addresses will be blocked on devices in the Aviation organization.

C. Associated source IP addresses will be blocked on two FortiGate firewalls.

D. Associated source IP addresses will be blocked on devices in the Network CMDB group.

A. In an automation policy

B. In the associated rule under Action

C. In an incident policy

D. In the associated playbook under Remediation

A. You are using an invalid IP address in the Value column.

B. You are using the wrong Boolean operator in the Next column.

C. You are using an incorrect entry in the Operator column.

D. The two items are not grouped in parentheses ().

A. You can only change the severity of multiple rules at a time.

B. You can view, edit, or activate only one rule at a time

C. You can change the severity, activate, or deactivate multiple rules at a time.

D. You can only activate or deactivate multiple rules at a time.

A. Automatically, through an automation policy

B. Automatically, when a dashboard threshold is reached

C. Manually, through the incident details menu

D. Manually, through an event in an analytics search

A. Syslog

B. Pop-up window

C. Email

D. FortiSIEM Case