Fortinet NSE6_FSM_AN-7.4 - Fortinet NSE 6 - FortiSIEM 7.4 Analyst Exam
Page: 3 / 13
Total 65 questions
Question #11 (Topic: Exam A)
Refer to the exhibit.
Why is this search not producing any results?
Why is this search not producing any results?
A. You cannot reference both the User and Event Type attributes in the same analytics search.
B. You did not use the configuration management database (CMDB) group search properly.
C. You must set the Time Range to Real-time to identify login failures.
D. There is a nested query attribute type mismatch.
E. You must set the Operator to = for both queries.
Answer: D
Question #12 (Topic: Exam A)
Refer to the exhibit.
Which two lookup types can you reference as the subquery in a nested analytics query? (Choose two.)
Which two lookup types can you reference as the subquery in a nested analytics query? (Choose two.)
A. CMDB query
B. LDAP query
C. Event query
D. API query
Answer: AC
Question #13 (Topic: Exam A)
Refer to the exhibit.
What does the Group: Windows value refer to?
What does the Group: Windows value refer to?
A. A Windows Active Directory (AD) user group
B. A configuration management database (CMDB) device group
C. A SOC analyst group
D. A FortiSIEM user group
Answer: B
Question #14 (Topic: Exam A)
Refer to the exhibit.
What is this rule attempting to match?
What is this rule attempting to match?
A. Failed VPN logon attempts from three or more different outside countries.
B. Failed VPN logon attempts from three or more different sources inside the home country.
C. Excessive VPN logon failures from a source inside the home country.
D. Failed VPN logon events from a source outside the home country.
Answer: D
Question #15 (Topic: Exam A)
Which two categories can you map to the MITRE ATT&CK coverage tables on FortiSIEM? (Choose two.)
A. Incidents
B. CMDB Entries
C. Rules
D. Threats
E. Procedures
Answer: CD
