最新的Fortinet NSE6_FSM_AN-7.4免費考試真題

問題1

Refer to the exhibit. When the subpattern is matched, what does the time condition of 60 seconds mean?

A. It is the time period over which the rule will aggregate and evaluate events.

B. The rule will trigger remediation actions every 60 seconds when the subpattern is triggered.

C. The rule engine will evaluate events every 60 seconds looking for the subpattern.

D. The subpattern must be matched at least twice within 60 seconds to trigger this rule.

正確答案: A

說明：（僅 Fast2test 成員可見）

問題2

Which three types of data can you use to train FortiSIEM machine learning (ML)? (Choose three.)

A. FortiSIEM analytical reports

B. CSV files

C. Configuration management database (CMDB)

D. SQL database

E. FortiSIEM ML job

正確答案: A,B,D

說明：（僅 Fast2test 成員可見）

問題3

Which rule logic should you use to apply a user entity and behavior analytics (UEBA) tag to an event for a failed login incident by the account JSmith?

A. Username IS jsmith

B. Username START WITH smith

C. User = smith

D. User CONTAIN smith

正確答案: A

說明：（僅 Fast2test 成員可見）

問題4

A critical server is sending traffic that is triggering a high severity outbound intrusion prevention system (IPS) permitted IPS exploit rule. This traffic must be allowed. Which two items must you configure to prevent this sever from triggering the incident? (Choose two.)

A. Modify the aggregate count in the subpattern.

B. Create a rule exception for the IP address.

C. Change the time window on the rule conditions.

D. Modify the group by parameters to exclude the IP address.

E. Modify the subpattern filter to exclude the IP address.

正確答案: B,E

說明：（僅 Fast2test 成員可見）

問題5

Refer to the exhibit.

Which statement about the nested query shown in the exhibit is true?

A. The outer query could have also referenced the Reporting IP address field from the inner query.

B. The outer query could have also referenced the Protocol field from the inner query.

C. The outer query should have used the operator CONTAINS when referencing the inner query.

D. The outer query could have referenced all the queried fields from the inner query.

正確答案: A

說明：（僅 Fast2test 成員可見）

問題6

Refer to the exhibit.

What is the Group: VPN Gateway value a reference to?

A. A FortiGate address group

B. A FortiSIEM watchlist

C. A configuration management database (CMDB) device group

D. A FortiSIEM rule folder

正確答案: C

說明：（僅 Fast2test 成員可見）

問題7

What are two required components in a rule? (Choose two.)

A. Subpattern

B. Detection technology

C. Tag

D. Clear policy

正確答案: A,D

說明：（僅 Fast2test 成員可見）

問題8

When using user and entity behavior analytics (UEBA) on FortiSIEM, what can you use to dynamically supply a list of suspicious IP addresses to FortiGate for blocking?

A. Secure Copy Protocol (SCP)

B. FortiSIEM watchlists

C. FortiSIEM lookup tables

D. The Fortinet Security Fabric

正確答案: B

說明：（僅 Fast2test 成員可見）

問題9

Refer to the exhibit. Which two actions can you select in an automation policy to trigger an API call to block an IP address on a FortiGate? (Choose two.)

A. Send Email/SMS/Webhook to the target users

B. Run Remediation/Script

C. Open Remedy ticket using the configuration set in

D. Run Playbook on Incident Trigger

E. Invoke an Integration Policy

正確答案: B,E

說明：（僅 Fast2test 成員可見）

問題10

Refer to the exhibits.

You are troubleshooting why the rule shown in the exhibit is generating incidents for successful Remote Desktop Protocol (RDP) connections with correct logins. It should only be triggering when a person fails a login three or more times to the target device when connecting with RDP.
What is causing the rule to be triggered by correct login events?

A. The Boolean between the subpatterns is incorrect.

B. The subpattern relationship RDP_Connection:User = Failed_Logon:User never matches.

C. The RDP login is different from the login used to access the target device.

D. The attribute types in the subpatterns do not match

正確答案: A

說明：（僅 Fast2test 成員可見）

最新的Fortinet NSE 6 - FortiSIEM 7.4 Analyst - NSE6_FSM_AN-7.4免費考試真題

聯系我們

站內鏈接

最新更新