NSE5-FSM-6-3 sample questions

Question 1

A FortiSIEM administrator is investigating a performance issue where the Supervisor node's CPU utilization is consistently high. After initial investigation, the cause is determined to be an excessive number of low-value syslog events coming from a newly added group of IoT devices. The security team has confirmed these specific events are not needed for analysis. What is the most efficient method within FortiSIEM to reduce the processing load on the Supervisor without losing visibility into other critical events from the same IoT devices?

Accepted Answer

Implement an event dropping filter policy on the Collector that is receiving the IoT device logs.

Answer

Create a custom parser on the Supervisor to drop the unwanted events after they are received.

Answer

Increase the CPU and memory resources of the Supervisor virtual machine.

Answer

Create a rule on the Supervisor that triggers on the unwanted events and sets the action to 'Do not write to EventDB'.

Question 2

True or False: In a multi-tenant FortiSIEM deployment, administrators from one organization can view and manage incidents belonging to another organization if they are granted Super/Global administrator privileges.

Accepted Answer

False

Answer

True

Question 3

A financial institution is using FortiSIEM to monitor access to its critical database servers. A compliance requirement mandates a monthly report that shows a summary of distinct users who accessed each database server, along with the total number of connections per user. Which components of the FortiSIEM Analytics tab are required to create this specific report? (Select TWO)

Accepted Answer

The 'Group By' function using the attributes `destIpAddr` and `srcUserName`.

Accepted Answer

A 'COUNT' aggregation on the 'Matched Events' attribute.

Answer

A simple filter for the `destIpAddr` of the database servers.

Answer

The 'Clear Condition' feature within the search.

Answer

A UEBA watchlist for the database servers.

Question 4

An administrator at a retail company is deploying a new FortiSIEM Collector in a branch store. After deployment, the Collector appears online in the FortiSIEM GUI, but no events from the store's devices are appearing in the central analytics console. The administrator has verified that devices are successfully sending syslog messages to the Collector's IP address. Which of the following is the most likely cause of this issue?

Accepted Answer

A firewall between the branch store and the data center is blocking outbound HTTPS (TCP/443) traffic from the Collector to the Worker nodes.

Answer

The Supervisor node is offline.

Answer

The Collector has not been properly licensed.

Answer

The event parsers for the store's devices have not been enabled on the Collector.

Question 5

A security team wants to create an incident that triggers when any user is added to a privileged group in Active Directory, such as 'Domain Admins'. However, they want to prevent an incident from being created if the change was performed by an approved administrator account (e.g., 'svc-ad-admin'). Which rule component should be used to achieve this?

Accepted Answer

The Filters section with an exception

Answer

The Group By section

Answer

The Aggregate section

Answer

The Clear Condition section

Question 6

What is the primary purpose of the 'Define Condition' time field within a FortiSIEM rule?

Accepted Answer

To define the time period over which the events in the rule's sub-patterns are evaluated for correlation.

Answer

To specify the time of day the rule is allowed to trigger.

Answer

To set how long an incident generated by the rule will remain active before being automatically cleared.

Answer

To determine how often the rule's logic is checked against the event database.

Question 7

A systems administrator is tasked with deploying the FortiSIEM Windows Agent to 500 workstations across the enterprise. Which deployment method offers the most efficient and scalable solution for this task?

Accepted Answer

Using a software deployment tool, such as Microsoft Group Policy (GPO) or SCCM, to distribute the agent's MSI package.

Answer

Manually installing the agent on each workstation using the executable installer.

Answer

Using the FortiSIEM GUI to push the agent to each workstation individually.

Answer

Relying on agentless WMI monitoring for all 500 workstations.

Question 8

An organization has configured a rule that generates a 'Malware Detected' incident. The security policy requires that when this incident is triggered, the infected endpoint's IP address is automatically added to a blocklist on the network's FortiGate firewall. Which two FortiSIEM components are primarily involved in this automated remediation process? (Select TWO)

Accepted Answer

A Notification Policy that defines the remediation action.

Accepted Answer

The CMDB entry for the FortiGate device containing the necessary API credentials.

Answer

A custom parser for the FortiGate logs.

Answer

A report that lists all malware incidents.

Question 9

A security analyst is building a query to investigate suspicious network traffic. The goal is to see the raw log for every event associated with a specific destination IP address. However, when the analyst includes both `Raw Event Log` and `destIpAddr` in the 'Display Fields' of an aggregated query, an error occurs. Why does this happen?

Accepted Answer

The `Raw Event Log` attribute is not a parsable field and cannot be logically grouped or displayed with structured attributes like `destIpAddr` in an aggregated view.

Answer

`Raw Event Log` can only be displayed when grouped by `reptDevIpAddr`.

Answer

The system requires `Raw Event Log` to be the only field in the 'Display Fields' for performance reasons.

Answer

An administrator must first enable a special 'Raw Log Display' setting in the system configuration.

Question 10

A FortiSIEM administrator is reviewing the system architecture and notices three main component types: Supervisor, Worker, and Collector. What is the specific function of the Worker nodes in this architecture?
```mermaid
graph TD
subgraph Central_Datacenter
Supervisor[Supervisor]
Worker1[Worker 1]
Worker2[Worker 2]
EventDB[(Event DB)]
CMDB[(CMDB)]
end

subgraph Remote_Site_A
Collector_A[Collector A]
end

subgraph Remote_Site_B
Collector_B[Collector B]
end

Accepted Answer

To perform real-time event correlation, run analytics queries, and write events to the database.

Answer

To collect and parse raw logs from devices.

Answer

To provide the web-based GUI and manage the entire cluster.

Answer

To store the long-term event data in the Profile DB.

Free NSE5-FSM-6-3 sample questions

True or False: In a multi-tenant FortiSIEM deployment, administrators from one organization can view and manage incidents belonging to another organization if they are granted Super/Global administrator privileges.

What is the primary purpose of the 'Define Condition' time field within a FortiSIEM rule?

A systems administrator is tasked with deploying the FortiSIEM Windows Agent to 500 workstations across the enterprise. Which deployment method offers the most efficient and scalable solution for this task?

10 more free samples are waiting