NSE6 FortiSIEM Analyst Practice Questions & Answers • ExamPrepare

Question 1

Refer to the exhibit.

Which statement about the time range settings defined in the nested query is accurate?

Analytics Search

FortiSIEM will search in real time using 10 minute blocks for a source IP address that is not in the Approved Devices report from the last 30 days.
FortiSIEM will search the last 30 days of events for a source IP address that is not in the Approved Devices report.
FortiSIEM will list source IP addresses found the last 10 minutes of events from each day in the Approved Devices report from the last 30 days.
FortiSIEM will search the last 10 minutes of events for a source IP address that is not in the Approved Devices report from the last 30 days.

Select an answer above, then submit your vote. Reading or practicing does not cast a vote.

Question 2

Which three steps can you reference multiple times in a playbook? (Choose three.)

Select an answer above, then submit your vote. Reading or practicing does not cast a vote.

Question 3

Refer to the exhibit.

An incorrect configuration is shown.

Which setting must you change to successfully apply this configuration to FortiSIEM?

Machine Learning - Training Configuration

Select the same values in the Fields to use for Prediction and Field to Predict sections.
Set the algorithm to Anomaly Detection .
Set the Train factor to 70% or greater.
Set the Run Mode to ML .

Select an answer above, then submit your vote. Reading or practicing does not cast a vote.

Question 4

Which rule logic should you use to apply a user entity and behavior analytics (UEBA) tag to an event for a failed login incident by the account JSmith?

Username IS jsmith
User = smith
User CONTAIN smith
Username START WITH smith

Select an answer above, then submit your vote. Reading or practicing does not cast a vote.

Question 5

Refer to the exhibit. According to the automation policy configuration shown

Refer to the exhibit.

According to the automation policy configuration shown in the exhibit, what happens if an associated rule triggers?

FortiSIEM sends an email.
FortiSIEM runs the remediation script.
FortiSIEM runs everything except the playbook, because the playbook and the remediation script perform similar functions.
FortiSIEM executes all the actions.

Select an answer above, then submit your vote. Reading or practicing does not cast a vote.

Question 6

Which two processes run analytical queries and must always be running to perform searches? (Choose two.)

Select an answer above, then submit your vote. Reading or practicing does not cast a vote.