Choose NSE6_FSM_AN-7.4 most accurate study material

Fortinet NSE6_FSM_AN-7.4 Exam Overview:

Fortinet NSE6_FSM_AN-7.4 Exam Syllabus Topics:

Fortinet NSE 6 - FortiSIEM 7.4 Analyst Sample Questions:

1. Refer to the exhibit.

The configuration shown in the exhibit is incorrect.
What must you change to allow this configuration to be successfully applied to FortiSIEM?

A) Run Mode must be set to ML.
B) The selection in Fields to use for Prediction and Field to Predict must match.
C) Only one AVG type field must be selected under Fields to use for Prediction.
D) The Train factor must be 70% or greater.

2. Refer to the exhibits.



Three events are collected over 10 minutes from two servers: Server A and Server B.
Based on the settings for the rule subpattern and a 10-minute condition window, how many incidents will the servers generate?

A) Server A will generate one incident and Server B will generate one incident.
B) Server A will generate three incidents and server B will generate one incident.
C) Server A will generate one incident and Server B will not generate any incidents
D) Server A will not generate any incidents and Server B will not generate any incidents.

3. Refer to the exhibit. If the Capture Variable step ingests the source IP address from an incident and the Block Source IP on FGT step blocks that source IP address on the configured firewall, what will happen when this playbook is executed?

A) Three different source IP addresses, depending on the network configuration of the firewalls, will be blocked.
B) A single source IP address from the incident will be blocked on the first playbook connector.
C) A different source IP address, depending on the organization, will be blocked on all three firewalls.
D) The same source IP address will be blocked on all three firewalls.

4. Refer to the exhibit.

Which statement about the time range settings defined in the nested query is accurate?

A) FortiSIEM will search the last 30 days of events for a source IP address that is not in the Approved Devices report.
B) FortiSIEM will list source IP addresses found the last 10 minutes of events from each day in the Approved Devices report from the last 30 days.
C) FortiSIEM will search the last 10 minutes of events for a source IP address that is not in the Approved Devices report from the last 30 days.
D) FortiSIEM will search in real time using 10 minute blocks for a source IP address that is not in the Approved Devices report from the last 30 days.

5. Refer to the exhibit.

An incorrect configuration is shown.
Which setting must you change to successfully apply this configuration to FortiSIEM?

A) Select the same values in the Fields to use for Prediction and Field to Predict sections.
B) Set the Run Mode to ML.
C) Set the algorithm to Anomaly Detection.
D) Set the Train factor to 70% or greater.

Solutions: