NSE6_FSM_AN-7.4問題集、Fortinet実際の試験問題

質問 1

Refer to the exhibit.

Which statement about the time range settings defined in the nested query is accurate?

A. FortiSIEM will search the last 10 minutes of events for a source IP address that is not in the Approved Devices report from the last 30 days.

B. FortiSIEM will search the last 30 days of events for a source IP address that is not in the Approved Devices report.

C. FortiSIEM will search in real time using 10 minute blocks for a source IP address that is not in the Approved Devices report from the last 30 days.

D. FortiSIEM will list source IP addresses found the last 10 minutes of events from each day in the Approved Devices report from the last 30 days.

正解: A

解説: (PassTest メンバーにのみ表示されます)

質問 2

Refer to the exhibit.
The configuration for a machine learning (ML) dataset using anomaly detection is shown.

If data for this model is generated every hour, how long must the FortiSIEM device be up before it can produce a valid training set?

A. 10 hours

B. 3 hours

C. 30 hours

D. 24 hours

正解: A

解説: (PassTest メンバーにのみ表示されます)

質問 3

You want to build an event query that displays only events to higher number destination ports (1024-65535). Which analytic search string is valid for this scenario?

A. Destination TCP/UDP Port BETWEEN 1024-65535

B. Destination TCP/UDP Port >= 1024 AND Destination TCP/UDP Port <= 65535

C. Destination TCP/UDP Port = 1024-65535

D. Destination TCP/UDP Port > 1024

正解: B

解説: (PassTest メンバーにのみ表示されます)

質問 4

From which two sources can you import data to train FortiSIEM machine learning? (Choose two.)

A. Syslog archives

B. FortiSIEM reports

C. SQL database

D. CSV files

正解: B,D

質問 5

You need a model for predicting a target field based on other fields in a dataset and then trigger an anomaly if the value does not match the prediction. Which machine learning algorithm will build this type of model?

A. Regression

B. Forecasting

C. Clustering

D. Regression

正解: D

解説: (PassTest メンバーにのみ表示されます)

質問 6

How can an administrator restrict the application of an automation policy on FortiSIEM? (Choose two.)

A. Apply the automation policy to specific Rules and Rule Groups

B. Apply the automation policy to specific Organizations

C. Apply the automation policy to specific Event Types

D. Apply the automation policy to a specific Incident and Incident Groups

正解: A,B

解説: (PassTest メンバーにのみ表示されます)

質問 7

Several new internal servers are generating incidents and must be excluded from several FortiSIEM rules. How must you tune rules to exclude several undiscovered devices from rules?

A. Add the devices to a rule exclusion automation policy.

B. Add them to the global exclusion list.

C. Add them to a device group that is being filtered by the rules.

D. Add their associated discovery credentials.

正解: C

解説: (PassTest メンバーにのみ表示されます)

質問 8

Refer to the exhibit. Which section contains settings that determine which attribute associations are used to trigger an incident?

A. Aggregate

B. Name

C. Group By

D. Filters

正解: C

質問 9

Refer to the exhibit. According to the automation policy configuration shown in the exhibit, what happens if an associated rule triggers?

A. FortiSIEM executes all the actions.

B. FortiSIEM runs the remediation script.

C. FortiSIEM sends an email.

D. FortiSIEM runs everything except the playbook, because the playbook and the remediation script perform similar functions.

正解: A

解説: (PassTest メンバーにのみ表示されます)

質問 10

Refer to the exhibits.

You want the rule shown in the exhibit to trigger when three failed login attempts occur within 3 minutes.
Which condition time window and aggregate values are correct for your objective?

A. Time window 60 seconds, aggregate value 3

B. Time window 540 seconds, aggregate value 3

C. Time window 180 seconds, aggregate value 3

D. Time window 180 seconds, aggregate value 2

正解: D

解説: (PassTest メンバーにのみ表示されます)

Fortinet NSE 6 - FortiSIEM 7.4 Analyst - NSE6_FSM_AN-7.4 模擬練習