Fortinet NSE6_FSM_AN-7.4 Exam With Confidence Using Practice Dumps

The Incident Status shows " Auto Cleared " , and the Cleared Reason states: " Rule has not been triggered for 20 minutes. " This indicates that the incident was automatically cleared by the rule logic after a defined period of inactivity.

The correct answer is C because the exhibit shows the incident status as Auto Cleared and the cleared reason indicates that the rule condition was no longer being triggered. The Study Guide explains that FortiSIEM supports clear conditions and auto-clearing behavior at the rule level. It states that if a time-based clear condition is configured, FortiSIEM can auto-clear the incident after the last occurrence if the trigger condition no longer exists. It also explains pattern-based clear behavior: FortiSIEM evaluates clear-condition subpatterns and compares attributes from the clear condition with the original incident attributes. If the configured attributes match, the incident status is set to auto cleared. In the exhibit, the cleared reason says the rule has not been triggered for a defined number of minutes. That is not a manual action by the analyst and not an endpoint-generated all-clear signal. It is FortiSIEM’s rule-based clearing logic. Option B is also wrong because the exhibit shows a specific rule inactivity period, not a generic 24-hour timeout.

The correct answers are D. Run Remediation/Script and E. Run Playbook on Incident Trigger . FortiSIEM can block an IP address on a FortiGate through a remediation script or through a FortiSOAR playbook/connector workflow. The FortiSIEM Analyst Study Guide explains that for automatic remediation, you define a remediation script for a scenario, and that mitigation scripts can “block an IP address in a firewall” or disable a user in Active Directory. It also states that, when an automation policy is triggered and the remediation script option is enabled, FortiSIEM uses incident data and runs the script to quarantine or block the offending IP address on FortiGate.

FortiSIEM 7.4 also supports automatic playbook execution from an automation policy. The 7.4 User Guide states that under Admin > Settings > Automation Policy , you can choose Run Playbook on Incident Trigger and select a playbook. The same guide explains that FortiSOAR playbooks can call connectors, and the Fortinet FortiOS connector can perform actions such as Block IP Address on a FortiGate firewall.

Email, Remedy tickets, and generic integration policies are notification/ticketing workflows, not the direct FortiGate IP-block actions.

The correct answer is B. FortiSIEM does not create a separate incident every time the same rule condition repeats. The FortiSIEM Study Guide explains that rules process events based on time periods, and if the same rule with the same incident conditions triggers repeatedly, FortiSIEM increases the count instead of creating a new incident. The incident list view includes the incident Count field for this purpose. The guide further explains that when an incident triggers for the first time, FortiSIEM sets First Occurred and Last Occurred to the same value. When the incident triggers again within the rule evaluation period, FortiSIEM increases the count and updates Last Occurred, while the triggered Events view displays the latest event data. This behavior prevents duplicate incident flooding while preserving evidence that the condition is recurring. Option A is incorrect because FortiSIEM does not use a “Repeated” incident status. Option C and D are incorrect because FortiSIEM does not generate a new incident for every repeated trigger when the incident conditions match an already active incident.