Pass the Fortinet NSE 6 Network Security Specialist NSE6_FSM_AN-7.4 Questions and answers with ExamsMirror

The verified answer is D. Five . FortiSIEM grouping is based on unique combinations of the selected Group By fields. The Study Guide explains this behavior clearly: if multiple events have the same selected Group By values, “they are grouped together in one row,” and the count column tracks the number of events for each row. In this question, the selected fields are User and Count . The six raw rows contain these combinations: Mike/4, Bob/3, Alice/2, Alice/2, Bob/6, and Mike/5. Because Alice/2 appears twice, those two rows are grouped into a single result. The remaining combinations are unique. So FortiSIEM displays five grouped results, not six. Six would be correct only if every row had a unique User-and-Count combination, or if grouping included another differentiating attribute such as Source IP. Since the question specifically groups only by User and Count, duplicate User/Count pairs collapse into one row. Therefore, the correct result count is five .

The correct answer is A. FortiSIEM supports bulk rule operations for selected rules. The FortiSIEM 7.4 User Guide states that if you have permission to activate a rule, you can activate or deactivate multiple rules with a single click. The procedure instructs the user to go to Resources > Rules, click the edit icon, select Multiple Rules, choose the rules, and then use the Select Actions panel. In that panel, the guide states that you can select a Severity from the Severity drop-down list to change the selected rules, and you can also select or deselect active status options for new or existing organizations to make the selected rules active or inactive. This proves that both operations are available: severity changes and activation/deactivation changes. Option B is too restrictive because FortiSIEM allows multiple-rule selection. Option C is incomplete because activation/deactivation is also supported. Option D is incomplete because severity changes are also supported. Therefore, the correct answer is that you can change severity and activate or deactivate multiple selected rules.

The correct answers are A. Process and C. Resources. FortiSIEM UEBA/EBA analytics uses endpoint and behavior-related telemetry to identify abnormal activity. The Study Guide explains that the UEBA incident dashboard shows incidents that the AI module creates based on alerts received from FortiInsight. The UEBA attribute list includes the incident name, host, application, user, tag, and activity. This aligns with process-oriented activity monitoring from endpoint agents. The performance and baseline lessons also explain that FortiSIEM collects performance and availability data from devices and applications, including resource-utilization metrics, and uses that information to build baselines and detect anomalous activity. Resource behavior includes CPU, memory, disk, I/O, and similar utilization patterns, which are valid behavioral-model inputs. Location and Network are important FortiSIEM context areas, but in this question’s EBA machine learning model choices, the valid model areas are process behavior and resource behavior. Process reflects what is running or being executed; Resources reflects system or application utilization behavior. Together, these are the two data areas used for EBA machine learning models.

The correct answer is A . In FortiSIEM machine learning training, the Train factor controls how much of the prepared dataset is used for training and how much is reserved for testing. The FortiSIEM 7.4 User Guide states in the regression training procedure that the analyst must choose the Train factor and that it “should be greater than 70%.” It also explains the meaning of the value: 70% of the data is used for training and 30% is used for testing. This directly supports option A. Option B is incorrect because the supported running modes include Local, Local Auto, and AWS; “ML” is not the required run mode. Option C is incorrect because regression can use multiple fields for prediction; the guide instructs the user to choose the fields to use for prediction and the field to predict. Option D is incorrect because prediction input fields and target field should not be the same. Regression builds a model to predict a target field based on other fields, so the configuration must use a valid Train factor rather than matching predictor and target fields.

The correct answer is B because the analyst is searching for events to either of two destination IP addresses, but the filter uses the wrong Boolean relationship. The FortiSIEM Study Guide explains structured searches with multiple conditions and states that “when you use multiple conditions, you must specify the next logical operator between conditions.” It gives a direct example: when searching for events from two specific devices, the first condition is one IP address, the second condition is another IP address, and “the next logical operator between the two conditions is an OR operator, because the search is for events from condition 1 OR condition 2.” The same logic applies here. A single event cannot usually have Destination IP equal to 10.10.1.1 and Destination IP equal to 192.168.1.1 at the same time. Using AND requires both conditions to be true simultaneously, so no results are returned. The correct operator between the two Destination IP conditions is OR.

The time period must be defined under the Define Condition tab of the rule. The FortiSIEM Study Guide states that a rule has three components: General , Condition , and Action . The General section defines the overall purpose and scope of the rule, the Condition section specifies which conditions trigger the rule, and the Action section configures what happens after the rule is triggered. The Study Guide further explains that on the Define Condition page, FortiSIEM specifies “the conditions—event attributes and thresholds—that will trigger the rule and create an incident,” including “the time window” within which the subpatterns must match for the rule condition to be satisfied. It also states that when there is more than one subpattern, you must define the logic between subpatterns and their relationships or constraints.

For a 24-hour multiple-subpattern rule, the guide gives an example using an 86400-second time window, which equals 24 hours, and shows it under Resource > Rules > Define Condition. Therefore, the time period is not configured inside each individual subpattern, not under General, and not under Define Action.

The correct answer is B because the configuration groups results by Source IP and Destination IP , while using COUNT(Matched Events) as a display/aggregate value. FortiSIEM’s grouping logic combines events only when the selected Group By attributes match. The Study Guide explains that Group By attributes determine how matching events are placed into rows, and that when multiple events share the same grouped values, “they are grouped together in one row.” The count column then tracks the number of events represented by that row. In the exhibit, Source IP and Destination IP are the grouping fields, so FortiSIEM displays each unique connection pair once. The count shows how many matching allowed firewall connection events were seen for each pair. Option A is not correct because the exhibit does not show sorting by destination IP hit count. Option C ignores the source and destination grouping. Option D would require grouping by source IP alone or by distinct destination counts per source, which is not the shown configuration.

The correct answer is A because CMDB objects are referenced from the Value field after selecting the appropriate event attribute and operator. The FortiSIEM Study Guide gives a structured search example that references the CMDB. In that example, the attribute is Reporting IP, the operator is IN, and the value is selected from CMDB groups such as Devices: Windows and Networks: Inside Net. The guide explains that to show events reported by Windows servers within a specific network, you set the attribute and operator first, then browse the CMDB and select the relevant CMDB group value. This confirms the workflow: the CMDB reference is chosen as the value of the condition, not as the attribute itself. Option B is incorrect because the CMDB tab is not used to launch the analytics search this way. Option C is not a valid workflow. Option D is wrong because the attribute is selected from event or CMDB attribute lists, while the CMDB object or group is selected in the value field.

The correct answer is D because Server A satisfies the rule’s threshold and count requirements, while Server B does not. The Study Guide explains that a FortiSIEM subpattern consists of Filter , Aggregate , and Group By components. It also states that the Aggregate function defines how many or what metric values must match during the time window, while Group By controls how the matching events are grouped into rows. The performance metrics lesson explains that FortiSIEM collects performance and availability data, converts polling results into logs, and uses those metrics for performance, availability, resource utilization, and baselining. In the exhibit, the aggregate evaluates CPU utilization against the device’s CPU critical threshold and also requires a matched-event count of at least two within the 10-minute window. Server A has CPU values above its critical threshold enough times in the window, so it generates one incident. Server B has a lower configured threshold but its collected CPU values do not satisfy the required aggregate condition for the grouped server. Therefore, only Server A generates an incident.

The correct answer is Local Auto. The uploaded answer was right, but its explanation was sloppy because it incorrectly described Local mode as the most time-consuming mode. In FortiSIEM machine learning, Local Auto mode selects the best algorithm by evaluating multiple candidate algorithms. The User Guide states that in Local Auto mode, “FortiSIEM picks the best algorithm” and that the Max Run Time parameter limits how long the job can run; longer runtime can produce better results. That is why Local Auto can take the most time. Forecasting and Regression are task types, not run modes.