Free Fortinet NSE6_FSM_AN-7.4 Exam Dumps Questions & Answers

When selecting multiple rules at once on FortiSIEM, which actions can you perform?

• A.  You can change the severity, activate, or deactivate multiple rules at a time.
• B.  You can only change the severity of multiple rules at a time.
• C.  You can only activate or deactivate multiple rules at a time.
• D.  You can view, edit, or activate only one rule at a time

A rule that detects network connections to an SSH server is triggering constantly in response to background internet traffic and must be tuned. Which method is used to tune this rule and solve the issue?

• A.  Increase the time window on the FortiSIEM rule.
• B.  Increase the COUNT (Matched Events)value in the subpattern.
• C.  Block connections from unauthorized networks before they reach the server.
• D.  Update the Group By attribute to include only allowed host IP addresses.

How does FortiSIEM update the incident details if the same rule triggers repeatedly?

• A.  FortiSIEM generates a new incident each time the rule triggers and updates all the First Seen and Last Seen timestamps.
• B.  FortiSIEM updates the Incident Count value and Last Seen timestamp.
• C.  FortiSIEM generates a new incident based on the Rule Frequency value, and updates the First Seen and Last Seen timestamps.
• D.  FortiSIEM changes the incident status to Repeated, and updates the Last Seen timestamp.

An analyst wants to run a remediation playbook when a user fails a VPN login five times from an external machine. Where do they associate the remediation playbook with the triggering rule?

• A.  In the associated playbook under Remediation
• B.  In an incident policy
• C.  In the associated rule under Action
• D.  In an automation policy

You want to build an event query that displays only events to higher number destination ports (1024-65535). Which analytic search string is valid for this scenario?

• A.  Destination TCP/UDP Port > 1024
• B.  Destination TCP/UDP Port >= 1024 AND Destination TCP/UDP Port <= 65535
• C.  Destination TCP/UDP Port BETWEEN 1024-65535
• D.  Destination TCP/UDP Port = 1024-65535