Fortinet NSE6_FSM_AN-7.4 Prüfungsthemen:
| Abschnitt | Ziele |
|---|---|
| Thema 1: Erweiterte Analytik und Integrationen | - ML, UEBA und ZTNA
|
| Thema 2: Analytik und Suche | - Abfrage- und Ereignisanalyse
|
| Thema 3: Regel- und Vorfallsverwaltung | - Vorfälle und Benachrichtigungen
|
| Thema 4: FortiEDR und Integration von Sicherheitsrichtlinien | - Sicherheitskonfiguration von FortiEDR
|
Fortinet NSE 6 - FortiSIEM 7.4 Analyst NSE6_FSM_AN-7.4 Prüfungsfragen mit Lösungen
1. How can an administrator restrict the application of an automation policy on FortiSIEM? (Choose two.)
A) Apply the automation policy to a specific Incident and Incident Groups
B) Apply the automation policy to specific Organizations
C) Apply the automation policy to specific Event Types
D) Apply the automation policy to specific Rules and Rule Groups
2. Refer to the exhibit.
You are investigating an issue with two destination IP addresses, but you are not getting any results from the search.
Based on the filters shown in the exhibit, why is this search returning no results?
A) You are using the wrong Boolean operator in the Next column.
B) The two items are not grouped in parentheses ().
C) You are using an incorrect entry in the Operator column.
D) You are using an invalid IP address in the Value column.
3. Refer to the exhibit. If you group the events by Reporting IP, Event Type, and User attributes, how many results will FortiSIEM display?
A) Four
B) Two
C) Three
D) Five
4. An analyst wants to create a rule from a new analytic search they just performed. Which method is the most efficient way for you to create the rule?
A) Make a new rule using the Create Rule option in the Actions menu.
B) Manually re-create the analytics search in the rule configuration.
C) Copy and paste the raw analytics search text into a rule subpattern.
D) Save the search as a template, and create a new rule from the template.
5. Refer to the exhibit. When the subpattern is matched, what does the time condition of 60 seconds mean?
A) The rule engine will evaluate events every 60 seconds looking for the subpattern.
B) The rule will trigger remediation actions every 60 seconds when the subpattern is triggered.
C) The subpattern must be matched at least twice within 60 seconds to trigger this rule.
D) It is the time period over which the rule will aggregate and evaluate events.
Fragen und Antworten:
| 1. Frage Antwort: B,D | 2. Frage Antwort: A | 3. Frage Antwort: C | 4. Frage Antwort: A | 5. Frage Antwort: D |
845 Kundenbewertungen
