Fortinet NSE6_FSM_AN-7.4 Exam With Confidence Using Practice Dumps

The correct answers are D. Run Remediation/Script and E. Run Playbook on Incident Trigger . FortiSIEM can block an IP address on a FortiGate through a remediation script or through a FortiSOAR playbook/connector workflow. The FortiSIEM Analyst Study Guide explains that for automatic remediation, you define a remediation script for a scenario, and that mitigation scripts can “block an IP address in a firewall” or disable a user in Active Directory. It also states that, when an automation policy is triggered and the remediation script option is enabled, FortiSIEM uses incident data and runs the script to quarantine or block the offending IP address on FortiGate.

FortiSIEM 7.4 also supports automatic playbook execution from an automation policy. The 7.4 User Guide states that under Admin > Settings > Automation Policy , you can choose Run Playbook on Incident Trigger and select a playbook. The same guide explains that FortiSOAR playbooks can call connectors, and the Fortinet FortiOS connector can perform actions such as Block IP Address on a FortiGate firewall.

Email, Remedy tickets, and generic integration policies are notification/ticketing workflows, not the direct FortiGate IP-block actions.

The correct answer is D. ZTNA tags. FortiSIEM 7.4 includes FortiEMS endpoint tagging integration. The FortiSIEM 7.4 User Guide states that FortiSIEM supports discovery of FortiEMS servers by using the FortiEMS Management Server API with basic username/password authentication. It also explains that after FortiEMS discovery, FortiSIEM can tag or untag a host by using classification tags on the FortiEMS server. In a ZTNA deployment, those tags are imported by member Fortinet devices, especially FortiGate firewalls, and are referenced in ZTNA firewall rules. The guide gives a common use case in which a host is tagged as suspicious or potentially compromised so firewall rules can isolate it or allow only minimal traffic. Host software versions, FortiSIEM license information, and host login credentials are not the FortiEMS API information relevant to this ZTNA tagging workflow. The API integration supports retrieving FortiEMS-managed host context and using classification/ZTNA tags for automated response and policy enforcement.

Grouping by User, Source IP, and Count means that each unique combination of those three attributes will be treated as a separate result. In the table, all six rows have distinct combinations of User, Source IP, and Count - so FortiSIEM will display 6 results.

Six because grouping by User , Source IP , and Count creates a separate result for every unique combination of those three selected attributes. The FortiSIEM Study Guide explains this grouping behavior in the single-subpattern rule example: “If multiple VPN login failure events have the same source IP address, reporting device, reporting IP address, and user, they are grouped together in one row, and the count column tracks the number of events for each of those rows.” Applying that rule here, FortiSIEM compares all selected Group By fields together. In the exhibit, every row has a unique Source IP address, even where the same user appears more than once. For example, Mike appears twice, but the Source IP and Count values are different. Alice appears twice with Count 2, but the Source IP values are different. Bob appears twice, but both Source IP and Count are different. Since no row has the same User, Source IP, and Count combination as another row, FortiSIEM displays all six rows.