Free and Premium Fortinet NSE6_FSM_AN-7.4 Dumps Questions Answers

The fields are highlighted in red because unique values such as Event Receive Time and Raw Event Log cannot be used in group-by operations. Grouping requires aggregatable or consistent values across events, while these fields are unique to each event, making them incompatible for grouping.

The correct answer is A because the highlighted fields are not valid for that grouped/aggregated display configuration. The FortiSIEM 7.4 User Guide notes that some event attributes, functions, and queries are not supported in specific analytics result-filter and display contexts. It lists date fields, including examples such as Event Receive Time , and also lists Raw Event Log and Binary Raw Event Log among unsupported fields for that context. The reason is practical: grouping requires stable values that can combine multiple events into meaningful grouped rows. Attributes such as Event Receive Time and Raw Event Log are highly specific to individual events. If every event has its own receive timestamp or unique raw log content, grouping by those fields defeats aggregation and can create one row per event rather than meaningful grouped output. COUNT(Matched Events) itself is a valid aggregate expression when used correctly. Event Receive Time is available in logs, but it is not appropriate as a grouped field in the configuration shown. Therefore, the red highlighting indicates invalid grouped fields caused by unique/non-groupable values.

The correct answer is B. FortiSIEM does not create a separate incident every time the same rule condition repeats. The FortiSIEM Study Guide explains that rules process events based on time periods, and if the same rule with the same incident conditions triggers repeatedly, FortiSIEM increases the count instead of creating a new incident. The incident list view includes the incident Count field for this purpose. The guide further explains that when an incident triggers for the first time, FortiSIEM sets First Occurred and Last Occurred to the same value. When the incident triggers again within the rule evaluation period, FortiSIEM increases the count and updates Last Occurred, while the triggered Events view displays the latest event data. This behavior prevents duplicate incident flooding while preserving evidence that the condition is recurring. Option A is incorrect because FortiSIEM does not use a “Repeated” incident status. Option C and D are incorrect because FortiSIEM does not generate a new incident for every repeated trigger when the incident conditions match an already active incident.

The correct answer is A because CMDB objects are referenced from the Value field after selecting the appropriate event attribute and operator. The FortiSIEM Study Guide gives a structured search example that references the CMDB. In that example, the attribute is Reporting IP, the operator is IN, and the value is selected from CMDB groups such as Devices: Windows and Networks: Inside Net. The guide explains that to show events reported by Windows servers within a specific network, you set the attribute and operator first, then browse the CMDB and select the relevant CMDB group value. This confirms the workflow: the CMDB reference is chosen as the value of the condition, not as the attribute itself. Option B is incorrect because the CMDB tab is not used to launch the analytics search this way. Option C is not a valid workflow. Option D is wrong because the attribute is selected from event or CMDB attribute lists, while the CMDB object or group is selected in the value field.

The verified answer is D. Five . FortiSIEM grouping is based on unique combinations of the selected Group By fields. The Study Guide explains this behavior clearly: if multiple events have the same selected Group By values, “they are grouped together in one row,” and the count column tracks the number of events for each row. In this question, the selected fields are User and Count . The six raw rows contain these combinations: Mike/4, Bob/3, Alice/2, Alice/2, Bob/6, and Mike/5. Because Alice/2 appears twice, those two rows are grouped into a single result. The remaining combinations are unique. So FortiSIEM displays five grouped results, not six. Six would be correct only if every row had a unique User-and-Count combination, or if grouping included another differentiating attribute such as Source IP. Since the question specifically groups only by User and Count, duplicate User/Count pairs collapse into one row. Therefore, the correct result count is five .

The correct answer is A. FortiSIEM agent. The FortiSIEM Study Guide identifies FortiSIEM agents as the component responsible for “file, log monitoring, and UEBA.” It also explains that FortiSIEM agents can be installed on endpoints or servers to provide data collection functions that native syslog may not provide. For Windows systems specifically, the guide states that Windows servers do not natively send syslog messages and that a FortiSIEM Windows agent can be installed to perform that function. The FortiSIEM 7.4 User Guide also confirms that FortiInsight UEBA functionality runs as an integrated module within the FortiSIEM Windows Agent in newer releases. SSH and SNMP are access or monitoring protocols; they can support discovery or performance monitoring, but they are not the UEBA data-sending component. A FortiSIEM worker performs analysis and search functions inside the FortiSIEM architecture; it is not installed on endpoints to collect UEBA telemetry. Therefore, the FortiSIEM agent is the correct mechanism for sending UEBA-relevant endpoint data to FortiSIEM.

Grouping by User, Source IP, and Count means that each unique combination of those three attributes will be treated as a separate result. In the table, all six rows have distinct combinations of User, Source IP, and Count - so FortiSIEM will display 6 results.

Six because grouping by User , Source IP , and Count creates a separate result for every unique combination of those three selected attributes. The FortiSIEM Study Guide explains this grouping behavior in the single-subpattern rule example: “If multiple VPN login failure events have the same source IP address, reporting device, reporting IP address, and user, they are grouped together in one row, and the count column tracks the number of events for each of those rows.” Applying that rule here, FortiSIEM compares all selected Group By fields together. In the exhibit, every row has a unique Source IP address, even where the same user appears more than once. For example, Mike appears twice, but the Source IP and Count values are different. Alice appears twice with Count 2, but the Source IP values are different. Bob appears twice, but both Source IP and Count are different. Since no row has the same User, Source IP, and Count combination as another row, FortiSIEM displays all six rows.

To detect three failed login attempts within three minutes, you must set the aggregate count to 3 in the subpattern and the time window to 180 seconds in the rule condition. This ensures the rule triggers only if three or more failed logins occur in that timeframe.

The correct answer is A because three minutes equals 180 seconds, and the aggregate threshold must be set to three matching events. The FortiSIEM Study Guide explains that rule conditions specify event attributes and thresholds that trigger the rule and create an incident. It further states that the time window defines the period within which the subpattern must match for the rule condition to be satisfied. The Study Guide’s single-subpattern rule example shows the same principle: the condition has a configured time window, and the Aggregate section uses a function such as COUNT(Matched Events) to require a minimum number of matching events. In this question, the analyst wants the rule to trigger when three failed login attempts happen within three minutes . Therefore, the rule condition time window must be 180 seconds , and the aggregate count must be 3 . A 90-second window would detect only events inside one and a half minutes, not the required three minutes. An aggregate count of 2 would trigger too early because the requirement is three failed attempts.

The correct answers are A. Process and C. Resources. FortiSIEM UEBA/EBA analytics uses endpoint and behavior-related telemetry to identify abnormal activity. The Study Guide explains that the UEBA incident dashboard shows incidents that the AI module creates based on alerts received from FortiInsight. The UEBA attribute list includes the incident name, host, application, user, tag, and activity. This aligns with process-oriented activity monitoring from endpoint agents. The performance and baseline lessons also explain that FortiSIEM collects performance and availability data from devices and applications, including resource-utilization metrics, and uses that information to build baselines and detect anomalous activity. Resource behavior includes CPU, memory, disk, I/O, and similar utilization patterns, which are valid behavioral-model inputs. Location and Network are important FortiSIEM context areas, but in this question’s EBA machine learning model choices, the valid model areas are process behavior and resource behavior. Process reflects what is running or being executed; Resources reflects system or application utilization behavior. Together, these are the two data areas used for EBA machine learning models.

The Incident Status shows " Auto Cleared " , and the Cleared Reason states: " Rule has not been triggered for 20 minutes. " This indicates that the incident was automatically cleared by the rule logic after a defined period of inactivity.

The correct answer is C because the exhibit shows the incident status as Auto Cleared and the cleared reason indicates that the rule condition was no longer being triggered. The Study Guide explains that FortiSIEM supports clear conditions and auto-clearing behavior at the rule level. It states that if a time-based clear condition is configured, FortiSIEM can auto-clear the incident after the last occurrence if the trigger condition no longer exists. It also explains pattern-based clear behavior: FortiSIEM evaluates clear-condition subpatterns and compares attributes from the clear condition with the original incident attributes. If the configured attributes match, the incident status is set to auto cleared. In the exhibit, the cleared reason says the rule has not been triggered for a defined number of minutes. That is not a manual action by the analyst and not an endpoint-generated all-clear signal. It is FortiSIEM’s rule-based clearing logic. Option B is also wrong because the exhibit shows a specific rule inactivity period, not a generic 24-hour timeout.

The correct answers are D. Run Remediation/Script and E. Run Playbook on Incident Trigger . FortiSIEM can block an IP address on a FortiGate through a remediation script or through a FortiSOAR playbook/connector workflow. The FortiSIEM Analyst Study Guide explains that for automatic remediation, you define a remediation script for a scenario, and that mitigation scripts can “block an IP address in a firewall” or disable a user in Active Directory. It also states that, when an automation policy is triggered and the remediation script option is enabled, FortiSIEM uses incident data and runs the script to quarantine or block the offending IP address on FortiGate.

FortiSIEM 7.4 also supports automatic playbook execution from an automation policy. The 7.4 User Guide states that under Admin > Settings > Automation Policy , you can choose Run Playbook on Incident Trigger and select a playbook. The same guide explains that FortiSOAR playbooks can call connectors, and the Fortinet FortiOS connector can perform actions such as Block IP Address on a FortiGate firewall.

Email, Remedy tickets, and generic integration policies are notification/ticketing workflows, not the direct FortiGate IP-block actions.

The correct answer is C. SSL . FortiSIEM receives raw logs, processes them through parsers, normalizes the extracted fields, classifies the event, and stores the structured data. The Study Guide explains the FortiSIEM process flow: data is collected, processed by the parsing engine, normalized, classified, and then stored. It further states that normalization extracts individual fields from raw events and maps those fields to a common schema. The FortiSIEM 7.4 User Guide describes a parser as a file containing instructions for the parser module to convert a raw log into event attributes. In the exhibit, the raw FortiGate log includes values such as profiletype= " applist " , appcat= " Network.Service " , and app= " SSL " . The field that directly represents the application value is app= " SSL " . Therefore, the parser would use SSL to populate the normalized Application Name field. applist describes the profile type, Network.Service is the application category, and wan1 is the interface, not the application name.

The correct answer is C because the rule’s Group By attributes determine how events are grouped before the aggregate condition is evaluated. The Study Guide explains that rule conditions are built from subpatterns consisting of event attribute filters and aggregation functions. It also explains that a subpattern combines filters, aggregate, and group by fields to form the rule logic. In this case, the filters may return matching events in Analytics, but the rule still may not trigger because the aggregate condition is calculated separately for each unique Group By combination. The exhibit groups by Destination IP and User while applying COUNT(Source IP) > = 2. This means FortiSIEM does not count all matching events together. Instead, it counts only events that share the same Destination IP and User combination. If no single grouped combination reaches the aggregate threshold, no incident is created. The issue is not the event lookup, not the Destination Host Name format, and not necessarily the aggregate expression itself. The grouping logic is what restricts the counted event set.

The exhibit shows a machine learning Regression configuration. In FortiSIEM regression, selected numerical fields are used as predictors, and another field is selected as the value to predict. The FortiSIEM 7.4 User Guide’s Machine Learning section lists Regression separately and describes the training workflow, including selecting fields used by the algorithm. The exhibit shows Memory Utilization, Sent Bytes, and Received Bytes selected under Fields to use for Prediction, while CPU Utilization is selected under Field to Predict. This means Memory Utilization is an input variable used by the model. If memory utilization is consistently high during training or retraining, that higher value becomes part of the learned model pattern. FortiSIEM does not automatically trigger a high-memory incident merely because a regression input value is high; an incident would require inference behavior and an anomaly action or rule configuration. Option C is also wrong because FortiSIEM does not dynamically lower a CPU trigger threshold just because memory is high. The correct behavior is model update based on the higher observed input value.

The Aggregate section contains the condition COUNT(Matched Events) > = 1, which defines how many events must match the filter criteria for the rule to trigger. This is the subpattern configuration that determines the event threshold.

The correct answer is A. Aggregate . In FortiSIEM rule subpatterns, the Filter section defines which events are eligible for matching, but the Aggregate section defines the statistical or threshold condition that must be satisfied before the subpattern is considered matched. The Study Guide explains that rule conditions are built from subpatterns of event attribute filters and aggregation functions. It also states that a single-subpattern rule is formed by three fields: filters, aggregate, and group by. In the exhibit, the aggregate line is COUNT(Matched Events) > = 1. That expression directly specifies the number of matching events required to satisfy the subpattern. Group By only controls how matching events are partitioned into separate evaluation groups. Actions define what happens after a rule triggers, such as incident generation or notification. Filters define the event type or attribute criteria, but they do not define the required count threshold. Therefore, the section that determines how many matching events are needed is the Aggregate section.