NSE6_FSM_AN-7.4 Exam Training Practice Tests (Fortinet NSE 6

Question 1

Refer to the exhibit. When the subpattern is matched, what does the time condition of 60 seconds mean?

A. It is the time period over which the rule will aggregate and evaluate events. B. The rule will trigger remediation actions every 60 seconds when the subpattern is triggered. C. The rule engine will evaluate events every 60 seconds looking for the subpattern. D. The subpattern must be matched at least twice within 60 seconds to trigger this rule.

Correct Answer: A

Explanation: Only visible for TrainingDump members. You can sign-up / login (it's free).

Question 2

Refer to the exhibits. Which information will this analytics search display?

A. Failed login events from all servers defined in the CMDB B. Failed machine login events with a source IP address of servers in the Device IP report C. Failed login events from all servers in the Server Inventory configuration management database (CMDB) report D. All servers in the Logon Failure user group

Correct Answer: C

Explanation: Only visible for TrainingDump members. You can sign-up / login (it's free).

Question 3

You need a model that predicts a target field based on other fields in a dataset and then triggers an anomaly if the value does not match the prediction. Which machine learning (ML) algorithm will you use to build this type of model?

A. Forecasting B. Anomaly detection C. Classification D. Regression

Correct Answer: D

Explanation: Only visible for TrainingDump members. You can sign-up / login (it's free).

Question 4

What is one difference between a lookup table and a watchlist?

A. A watchlist can be updated through an API, and a lookup table cannot. B. A lookup table requires a parser to be able to query and interpret the data, a watchlist does not require a parser. C. Watch list entries do not expire, lookup table entries have a defined lifetime. D. A lookup table can have multiple columns, and a watchlist only has one.

Correct Answer: D

Explanation: Only visible for TrainingDump members. You can sign-up / login (it's free).

Question 5

Refer to the exhibit.

If you group these events by the User and Count attributes, how many unique results will FortiSIEM display?

A. Three B. Four C. Six D. Five

Correct Answer: D

Explanation: Only visible for TrainingDump members. You can sign-up / login (it's free).

Question 6

Refer to the exhibit. Why would the two entries shown in the exhibit be included in an incident action history?

A. An administrator has enabled the Notify on Incident Cleared option. B. Multiple new incidents have occurred and have triggered the rule threshold. C. The system cleared the incident and is configured to Send Email/SMS/Webhook to the target users. D. An analyst resolved and cleared the incident and the Do not notify when an incident is cleared by system option is not enabled in the automation policy.

Correct Answer: C

Explanation: Only visible for TrainingDump members. You can sign-up / login (it's free).

Question 7

Refer to the exhibit.

An analyst wants to perform a KMeans machine learning (ML) job on this data.
How many N clusters would be a good fit for the data?

A. Two B. One C. 50 D. 100

Correct Answer: A

Explanation: Only visible for TrainingDump members. You can sign-up / login (it's free).

Question 8

Refer to the exhibit. Why are some of the fields highlighted in red?

A. Multiple unique values cannot be grouped. B. No Raw Event Log attribute information is available. C. The attribute COUNT(Matched Events) is an invalid expression. D. The Event Receive Time attribute is a valid choice to sort by.

Correct Answer: A

Explanation: Only visible for TrainingDump members. You can sign-up / login (it's free).

Question 9

Refer to the exhibit. If you group the events by Reporting IP, Event Type, and User attributes, how many results will FortiSIEM display?

A. Two B. Three C. Four D. Five

Correct Answer: B

Explanation: Only visible for TrainingDump members. You can sign-up / login (it's free).

Question 10

When configuring machine learning (ML), in which step can you modify how the model fits the training data set?

A. Prepare Data B. Design C. Train D. Statistics

Correct Answer: D

Explanation: Only visible for TrainingDump members. You can sign-up / login (it's free).

Fortinet NSE 6 - FortiSIEM 7.4 Analyst - NSE6_FSM_AN-7.4 Exam Practice Test