Fortinet NSE6_FSM_AN-7.4 Fortinet NSE 6 - FortiSIEM 7.4 Analyst Exam Practice Test

The correct answer is D. The exhibit shows an outer event query using the Event Attribute filter Source IP NOT IN Device IP: Approved Devices. The outer query time range is set to Relative — Last 10 Minutes, so FortiSIEM searches only the event data from the last 10 minutes. The exhibit also shows a separate Nested Time Range set to Relative — Last 30 Days. In FortiSIEM nested searches, the nested time range applies to the inner report/subquery, not to the outer event search. The FortiSIEM 7.4 User Guide states that nested query functionality lets one query refer to results from another query, and for outer event / inner event nested searches, it instructs the user to “choose the time range for outer query” and separately “choose Nested Time Range for the inner query.” It also states that when an existing query is used as an inner query, “time range would be set separately” in the outer query configuration. Therefore, FortiSIEM searches the last 10 minutes of outer events and compares their Source IP values against the Device IP values returned by the Approved Devices report using the last 30 days nested time range.

The correct answer is A. FortiSIEM agent. The FortiSIEM Study Guide identifies FortiSIEM agents as the component responsible for “file, log monitoring, and UEBA.” It also explains that FortiSIEM agents can be installed on endpoints or servers to provide data collection functions that native syslog may not provide. For Windows systems specifically, the guide states that Windows servers do not natively send syslog messages and that a FortiSIEM Windows agent can be installed to perform that function. The FortiSIEM 7.4 User Guide also confirms that FortiInsight UEBA functionality runs as an integrated module within the FortiSIEM Windows Agent in newer releases. SSH and SNMP are access or monitoring protocols; they can support discovery or performance monitoring, but they are not the UEBA data-sending component. A FortiSIEM worker performs analysis and search functions inside the FortiSIEM architecture; it is not installed on endpoints to collect UEBA telemetry. Therefore, the FortiSIEM agent is the correct mechanism for sending UEBA-relevant endpoint data to FortiSIEM.

The rule is triggering on successful RDP connection events because the Next operator between the two subpatterns is set to OR . The FortiSIEM Study Guide explains that multiple subpattern rules are used when patterns must occur within a specific time period or when one of several patterns proves that an incident condition exists. It lists the OR operator as: “Subpattern X OR Subpattern Y occurred within the Time Window.” The same Study Guide further explains that if multiple patterns are used, FortiSIEM requires a next operator, and in the OR example, “an event that matches either” subpattern will trigger. It also states that because the next operator is OR, the constraint between the two subpatterns is not enforced.

In the exhibit, Subpattern 1 matches RDP traffic on TCP/UDP port 3389 from FortiGate traffic-forward events, while Subpattern 2 matches logon failure events with COUNT(Matched Events) > = 3. Because the rule uses OR, FortiSIEM can trigger when only the RDP connection subpattern matches, even if the failed-logon subpattern does not match. The correct logic should require both subpatterns to match with the intended relationship constraints, not either subpattern independently.

The rule is matching VPN logon failure events where the Source Country is outside the configured home country . In the exhibit, the filter section shows Event Type IN EventTypes: VPN Logon Failure and Source Country NOT IN GeoCountries: My Home . That means the source must be outside the home-country geo group. The aggregate condition shows COUNT(Matched Events) > = 3 , so the rule is looking for at least three matching failed VPN logon events. The Group By section uses Source IP and User , so FortiSIEM evaluates the count per unique source IP and user combination, not by different countries.

The FortiSIEM Study Guide explains that a rule subpattern contains three components: Filter , Aggregate , and Group By . It states that the filter identifies the matching event group, the aggregate function specifies how many events must match, and Group By combines events with the same grouped attributes into one row while the count tracks those events.

Option A is wrong because the rule does not count different countries. Options C and D are wrong because the source country is explicitly NOT IN My Home, not inside the home country.

FortiSIEM grouping works by combining events that have the same values for all selected Group By attributes. The Study Guide’s rule and subpattern example states that when multiple events have the same Group By values, “they are grouped together in one row, and the count column tracks the number of events for each of those rows.” In the exhibit, the selected grouping fields are Reporting Device, Reporting IP, and Application Category. The table contains six raw rows, but two rows share the same grouped combination: FW01 / 10.1.1.1 / DB . Those two rows are collapsed into one grouped result. The other combinations are unique: FW02 / 10.1.1.2 / WebApp, FW01 / 10.1.1.1 / SSH, FW03 / 10.1.1.3 / DB, and FW04 / 10.1.1.4 / SSH. That creates five grouped rows in total. FortiSIEM does not display six because grouping removes duplicate combinations, and it does not display four because only one duplicate combination exists.

The Incident Status shows " Auto Cleared " , and the Cleared Reason states: " Rule has not been triggered for 20 minutes. " This indicates that the incident was automatically cleared by the rule logic after a defined period of inactivity.

The correct answer is C because the exhibit shows the incident status as Auto Cleared and the cleared reason indicates that the rule condition was no longer being triggered. The Study Guide explains that FortiSIEM supports clear conditions and auto-clearing behavior at the rule level. It states that if a time-based clear condition is configured, FortiSIEM can auto-clear the incident after the last occurrence if the trigger condition no longer exists. It also explains pattern-based clear behavior: FortiSIEM evaluates clear-condition subpatterns and compares attributes from the clear condition with the original incident attributes. If the configured attributes match, the incident status is set to auto cleared. In the exhibit, the cleared reason says the rule has not been triggered for a defined number of minutes. That is not a manual action by the analyst and not an endpoint-generated all-clear signal. It is FortiSIEM’s rule-based clearing logic. Option B is also wrong because the exhibit shows a specific rule inactivity period, not a generic 24-hour timeout.

The correct answer is B because the configuration groups results by Source IP and Destination IP , while using COUNT(Matched Events) as a display/aggregate value. FortiSIEM’s grouping logic combines events only when the selected Group By attributes match. The Study Guide explains that Group By attributes determine how matching events are placed into rows, and that when multiple events share the same grouped values, “they are grouped together in one row.” The count column then tracks the number of events represented by that row. In the exhibit, Source IP and Destination IP are the grouping fields, so FortiSIEM displays each unique connection pair once. The count shows how many matching allowed firewall connection events were seen for each pair. Option A is not correct because the exhibit does not show sorting by destination IP hit count. Option C ignores the source and destination grouping. Option D would require grouping by source IP alone or by distinct destination counts per source, which is not the shown configuration.

The correct answer is C because the rule’s Group By attributes determine how events are grouped before the aggregate condition is evaluated. The Study Guide explains that rule conditions are built from subpatterns consisting of event attribute filters and aggregation functions. It also explains that a subpattern combines filters, aggregate, and group by fields to form the rule logic. In this case, the filters may return matching events in Analytics, but the rule still may not trigger because the aggregate condition is calculated separately for each unique Group By combination. The exhibit groups by Destination IP and User while applying COUNT(Source IP) > = 2. This means FortiSIEM does not count all matching events together. Instead, it counts only events that share the same Destination IP and User combination. If no single grouped combination reaches the aggregate threshold, no incident is created. The issue is not the event lookup, not the Destination Host Name format, and not necessarily the aggregate expression itself. The grouping logic is what restricts the counted event set.

The correct answer is C. Regression. Regression is the machine learning task used when a model predicts a target value based on other fields in a dataset. In FortiSIEM’s machine learning workflow, regression configuration includes selecting Fields to use for Prediction and a Field to Predict. The User Guide explains that during regression training, the analyst chooses the fields used for prediction and the field being predicted, then trains the model with a Train factor. This matches the question exactly: the model predicts a target based on other fields, and the inference phase can identify anomalies when observed values differ significantly from predicted values. Classification is used to assign records to discrete classes or categories, not to predict a continuous target metric from other variables. Clustering groups similar observations without a predefined target field. Forecasting predicts future values over time, normally based on time-series behavior. Because the question specifically describes predicting a target field from other dataset fields and detecting mismatch from the prediction, the correct machine learning method is Regression.

The operator is set to " = " , which performs an exact match on the entire raw event log, not a substring search. To find logs that contain the keyword " udp " , the analyst should use the CONTAIN operator instead. This will return all logs where " udp " appears anywhere in the raw log message.

The correct answer is D because the analyst is trying to search for raw logs that contain the keyword udp, but the filter uses the equality operator. The FortiSIEM Study Guide explains keyword searches in terms of Raw Event Log CONTAIN logic. In the keyword phrase search section, the guide states that without quotes, FortiSIEM searches raw event logs by using conditions such as Raw Event Log CONTAIN TCP OR Raw Event Log CONTAIN connection . Another analytics example explains that searching for TCP or UDP events uses the raw event log containing the keyword tcp or udp and that the search returns case-insensitive results for TCP and UDP. This directly eliminates option C. The time range is already set to the last two hours, which is correct for historical raw log searching. The problem is the operator. To find a keyword anywhere inside a raw log message, the analyst should use CONTAIN , not =.

The correct answer is C. CMDB user group . In FortiSIEM, users and user groups are maintained as CMDB objects and can be referenced in analytics filters and rule logic. The FortiSIEM 7.4 User Guide table of contents explicitly includes CMDB management for users, viewing user information, adding users, editing or deleting users, performing operations on users, and working with user groups. This confirms that user groups are part of the FortiSIEM CMDB data model. The query shown in the exhibit uses the Analytics filter with the User attribute and the value Group: FortiSIEM Analysts . That syntax indicates that FortiSIEM is referencing a FortiSIEM-defined user group from CMDB, not an LDAP group directly and not an Active Directory group directly. LDAP and Active Directory can be used to discover or authenticate users, but once referenced as a FortiSIEM analytics group value, the object is a CMDB user group. FortiSIEM organization groups are tenant/organization constructs and are not the same as CMDB user groups.

The correct answer is A. The FortiSIEM Study Guide explicitly lists Create Rule as one of the actions that can be performed directly from Analytics search results. The guide states that to perform actions on results, an analyst clicks Actions and can choose options such as Email Result, Export Result, Add Result to Case, Copy To New Tab, Save Report, and Create Rule. The rules lesson further explains what happens after clicking Create Rule: FortiSIEM opens a new rule configuration window and creates a subpattern based on the analytics search parameters. It states that FortiSIEM uses the analytics search filter conditions to create the rule subpattern filter conditions, uses the search display conditions to create the rule Group By conditions, and sets the Aggregate condition to COUNT(Matched Events) > = 1. Creating a new rule manually under Resources > Rules would work, but it is slower because the analyst must manually re-enter the search criteria. The direct Analytics > Actions > Create Rule workflow is the quickest method.

The correct answer is Local Auto. The uploaded answer was right, but its explanation was sloppy because it incorrectly described Local mode as the most time-consuming mode. In FortiSIEM machine learning, Local Auto mode selects the best algorithm by evaluating multiple candidate algorithms. The User Guide states that in Local Auto mode, “FortiSIEM picks the best algorithm” and that the Max Run Time parameter limits how long the job can run; longer runtime can produce better results. That is why Local Auto can take the most time. Forecasting and Regression are task types, not run modes.

The correct syntax is COUNT(Matched Events) - with proper capitalization and spacing - to generate a total count of matched events. The error in the exhibit likely stems from a formatting issue (e.g., lowercase count() or incorrect spacing), not the logical structure of the expression.

COUNT(Matched Events) . FortiSIEM uses aggregate functions inside rule subpatterns and analytics display fields to calculate values such as the number of matched events. The Study Guide explains that rule conditions are built from subpatterns of event attribute filters and aggregation functions. It also shows that the Aggregate section is where expressions such as COUNT(Matched Events) are used to define event-count thresholds. In the exhibit, the expression is intended to generate a total count of matched events. The proper function format is the aggregate function name followed by the target field inside parentheses. Therefore, COUNT(Matched Events) is syntactically valid. Options B, C, and D are invalid because they place the function name outside the standard function-call format or attach the argument incorrectly. This matters because FortiSIEM’s Expression Builder validates expressions according to function syntax. To count matched events, the function must be written as an aggregate operation over the Matched Events field.