NSE6_FSM_AN-7.4 practice questions 1–10

1. Question 1 · 10 in bank

   When selecting multiple rules at once on FortiSIEM, which actions can you perform?

   • AYou can change the severity, activate, or deactivate multiple rules at a time.
   • BYou can view, edit, or activate only one rule at a time
   • CYou can only activate or deactivate multiple rules at a time.
   • DYou can only change the severity of multiple rules at a time.

   Show answer

   Answer: A

   Next question

2. Question 2 · 10 in bank

   Refer to the exhibit. The configuration for a machine learning (ML) dataset using anomaly detection is shown.

   

   If data for this model is generated every hour, how long must the FortiSIEM device be up before it can produce a valid training set?

   • A3 hours
   • B10 hours
   • C24 hours
   • D30 hours

   Show answer

   Answer: B

   Next question

3. Question 3 · 10 in bank

   Rules on FortiSIEM are usually processed as events are collected (streaming). How can you create a rule to evaluate events over an 8-hour period?

   • AConfigure a report to run the analytical query and run the report every 8 hours.
   • BConfigure a crontab process on the FortiSIEM supervisor.
   • CConfigure a 28,000-second time window under the Define Conditions tab.
   • DSet the Evaluation Mode to Scheduled under the General tab.

   Show answer

   Answer: D

   Next question

4. Question 4 · 10 in bank

   Select 2

   Which two categories can you map to the MITRE ATT&CK coverage tables on FortiSIEM? (Choose two.)

   • AIncidents
   • BCMDB Entries
   • CRules
   • DThreats
   • EProcedures

   Show answer

   Answer: AC

   Next question

5. Question 5 · 10 in bank

   Select 2

   What are two required components in a rule? (Choose two.)

   • AClear policy
   • BSubpattern
   • CDetection technology
   • DTag

   Show answer

   Answer: AB

   Next question

6. Question 6 · 10 in bank

   You need a model that predicts a target field based on other fields in a dataset and then triggers an anomaly if the value does not match the prediction. Which machine learning (ML) algorithm will you use to build this type of model?

   • ARegression
   • BAnomaly detection
   • CForecasting
   • DClassification

   Show answer

   Answer: A

   Next question

7. Question 7 · 10 in bank

   You want to create a rule with multiple subpatterns but trigger an incident only if three different subpatterns are matched over a 24-hour period. Where must you define the time period that the rule uses to evaluate all the subpatterns?

   • ADefine the time window in each individual subpattern.
   • BDefine the time window under the General tab of the rule
   • CDefine the time window under the Define Condition tab of the rule
   • DDefine the time window in the Define Action section of the rule.

   Show answer

   Answer: B

   Next question

8. Question 8 · 10 in bank

   Refer to the exhibit.

   

   An incorrect configuration is shown. Which setting must you change to successfully apply this configuration to FortiSIEM?

   • ASelect the same values in the Fields to use for Prediction and Field to Predict sections.
   • BSet the Run Mode to ML.
   • CSet the Train factor to 70% or greater.
   • DSet the algorithm to Anomaly Detection.

   Show answer

   Answer: C

   Next question

9. Question 9 · 10 in bank

   Select 2

   Which two ways are rule tags used on FortiSIEM? (Choose two.)

   • AEvent searches
   • BPlaybook filtering
   • CZero trust network access (ZTNA) enforcement on FortiClient EMS
   • DAdministrative user permissions

   Show answer

   Answer: AB

   Next question

10. Question 10 · 10 in bank

    What are four incident status options on FortiSIEM?

    • AActive, cleared, false negative, false positive
    • BActive, auto cleared, cleared manually, system cleared
    • CActive, auto closed, closed manually, system closed
    • DActive, closed, cleared, resolved

    Show answer

    Answer: D

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

NSE6_FSM_AN-7.4 practice, question 1. 10 questions available.