Online Access Free NSE6_FSM_AN-7.4 Exam Questions

Refer to the exhibit. Which two items can be referenced in the incident details when this rule is triggered and creates an incident? (Choose two.)

• A.COUNT(Matched Events)
• B.Domain Account Lockout
• C.Event Type
• D.Reporting Device
• E.User

Which two processes run analytical queries and must always be running to perform searches?
(Choose two.)

• A.phRuleWorker
• B.phQueryMaster
• C.phAnomalyMaster
• D.phRuleMaster
• E.phQueryWorker

From which two sources can you import data to train FortiSIEM machine learning? (Choose two.)

• A.CSV files
• B.Syslog archives
• C.SQL database
• D.FortiSIEM reports

Refer to the exhibit. Why would the two entries shown in the exhibit be included in an incident action history?

• A.Multiple new incidents have occurred and have triggered the rule threshold.
• B.An administrator has enabled the Notify on Incident Cleared option.
• C.The system cleared the incident and is configured to Send Email/SMS/Webhook to the target users.
• D.An analyst resolved and cleared the incident and the Do not notify when an incident is cleared by system option is not enabled in the automation policy.

In an automation policy, which two methods can you use to notify analysts when an incident is triggered? (Choose two.)

• A.Email
• B.Pop-up window
• C.FortiSIEM Case
• D.Syslog