Online Access Free NSE6_FSM_AN-7.4 Exam Questions

Refer to the exhibit. If the Capture Variable step ingests the source IP address from an incident and the Block Source IP on FGT step blocks that source IP address on the configured firewall, what will happen when this playbook is executed?

• A.A single source IP address from the incident will be blocked on the first playbook connector.
• B.A different source IP address, depending on the organization, will be blocked on all three firewalls.
• C.Three different source IP addresses, depending on the network configuration of the firewalls, will be blocked.
• D.The same source IP address will be blocked on all three firewalls.

What are the four incident status values on FortiSIEM?

• A.Active, auto cleared, cleared manually, system cleared
• B.Active, closed, cleared, resolved
• C.Active, auto closed, cleared manually, resolved
• D.Active, cleared, cleared manually, false positive

Refer to the exhibit. You want to use a machine learning (ML) model to train data with the following characteristics shown in the exhibit. Which ML model is the best fit to match the data in the exhibit?

• A.Anomaly detection
• B.Forecasting
• C.Elliptical envelope
• D.Clustering

Refer to the exhibit. Which value will the FortiSIEM parser use to populate the Application Name field?

• A.Network.Service
• B.Network Service
• C.Network.Service: SSL
• D.SSL

Refer to the exhibit.

FortiSIEM is receiving syslog events from a firewall.
You are trying to search raw event logs for traffic from the last two hours that contain the keyword
"UDP". However, you are getting no results from the search.
Based on the filter shown in the exhibit, why are you getting no search results?

• A.The AND operator in the Next column is the wrong operator for this type of search.
• B.You are using udp in the Value field, but you must use UDP.
• C.You can perform raw event log searches using only an Event Keyword search.
• D.The = operator in the Operator column is the wrong operator for this type of search.