NSE6_FSM_AN-7.4 Fortinet NSE 6 - FortiSIEM 7.4 Analyst Questions and Answers

The correct answer is C. CMDB user group . In FortiSIEM, users and user groups are maintained as CMDB objects and can be referenced in analytics filters and rule logic. The FortiSIEM 7.4 User Guide table of contents explicitly includes CMDB management for users, viewing user information, adding users, editing or deleting users, performing operations on users, and working with user groups. This confirms that user groups are part of the FortiSIEM CMDB data model. The query shown in the exhibit uses the Analytics filter with the User attribute and the value Group: FortiSIEM Analysts . That syntax indicates that FortiSIEM is referencing a FortiSIEM-defined user group from CMDB, not an LDAP group directly and not an Active Directory group directly. LDAP and Active Directory can be used to discover or authenticate users, but once referenced as a FortiSIEM analytics group value, the object is a CMDB user group. FortiSIEM organization groups are tenant/organization constructs and are not the same as CMDB user groups.

The correct answer is B. Train. In FortiSIEM machine learning, the Train step is where the model is built from the prepared dataset and where model-fitting behavior can be adjusted. The FortiSIEM 7.4 User Guide explains that after preparing data, the analyst goes to Analytics > Machine Learning > Train, selects the machine learning task, chooses the algorithm, selects the prediction/target fields when required, and chooses the Train factor, which determines how much data is used for training versus testing. The guide states that the Train factor should be greater than 70%, meaning 70% of the data is used for training and 30% for testing. It also explains that model quality metrics show how accurately the algorithm predicts the field. For regression, lower MAE means a better fit, and R2 shows how well predictions approximate real data points. Most importantly, the guide states: “If you want to change the algorithm parameters and re-train, then click Tune & Train, change the parameters and click Save & Train.” This confirms that modifying how the model fits the training dataset is done in the Train step, not Prepare Data, Statistics, or Design.

The rule is matching VPN logon failure events where the Source Country is outside the configured home country . In the exhibit, the filter section shows Event Type IN EventTypes: VPN Logon Failure and Source Country NOT IN GeoCountries: My Home . That means the source must be outside the home-country geo group. The aggregate condition shows COUNT(Matched Events) > = 3 , so the rule is looking for at least three matching failed VPN logon events. The Group By section uses Source IP and User , so FortiSIEM evaluates the count per unique source IP and user combination, not by different countries.

The FortiSIEM Study Guide explains that a rule subpattern contains three components: Filter , Aggregate , and Group By . It states that the filter identifies the matching event group, the aggregate function specifies how many events must match, and Group By combines events with the same grouped attributes into one row while the count tracks those events.

Option A is wrong because the rule does not count different countries. Options C and D are wrong because the source country is explicitly NOT IN My Home, not inside the home country.

The correct answer is C because the rule’s Group By attributes determine how events are grouped before the aggregate condition is evaluated. The Study Guide explains that rule conditions are built from subpatterns consisting of event attribute filters and aggregation functions. It also explains that a subpattern combines filters, aggregate, and group by fields to form the rule logic. In this case, the filters may return matching events in Analytics, but the rule still may not trigger because the aggregate condition is calculated separately for each unique Group By combination. The exhibit groups by Destination IP and User while applying COUNT(Source IP) > = 2. This means FortiSIEM does not count all matching events together. Instead, it counts only events that share the same Destination IP and User combination. If no single grouped combination reaches the aggregate threshold, no incident is created. The issue is not the event lookup, not the Destination Host Name format, and not necessarily the aggregate expression itself. The grouping logic is what restricts the counted event set.

The correct answer is B because the automation policy shown has the email/SMS/webhook notification action enabled, and the setting that suppresses notification for manual incident clearing is not selected. The FortiSIEM Study Guide explains that automation policies define actions taken when incident-related policy criteria match. It states that notification policies are defined by criteria such as severity, associated rules, time range, affected items, and actions. The guide also states that FortiSIEM can send email notifications and SMS messages to individuals or groups as part of an automation policy. In the exhibit, the options Do not notify when an incident is cleared automatically and Do not notify when an incident is cleared by system are selected, but Do not notify when an incident is cleared manually is not selected. Because the analyst clears the incident manually, the suppression condition does not apply. Therefore, FortiSIEM sends the configured email notification to the target user, identified in the question as the SOC manager.

The correct answer is A. Design. In the FortiSIEM 7.4 User Guide’s anomaly detection workflow, the first configuration step is Step 1: Design. In that step, FortiSIEM requires the analyst to identify the fields that will be analyzed by the machine learning job. The guide states that under Design, the analyst must identify Fields to Analyze, and explains that these fields are considered for anomaly detection and must currently be numerical fields. The guide also identifies the time field requirement for statistical deviation algorithms and notes that a FortiSIEM report is used to provide the dataset. The Prepare Data step comes later and is used to load or prepare the data source for training. The Train step runs the algorithm against the prepared dataset. The Schedule step is used after training to run inference. Therefore, the selection of fields to analyze belongs to the Design phase, not Prepare Data, Train, or Schedule. This sequence matters because FortiSIEM must know which numerical fields are relevant before it can prepare, train, or run inference on the machine learning job.

The correct answer is B because the configuration groups results by Source IP and Destination IP , while using COUNT(Matched Events) as a display/aggregate value. FortiSIEM’s grouping logic combines events only when the selected Group By attributes match. The Study Guide explains that Group By attributes determine how matching events are placed into rows, and that when multiple events share the same grouped values, “they are grouped together in one row.” The count column then tracks the number of events represented by that row. In the exhibit, Source IP and Destination IP are the grouping fields, so FortiSIEM displays each unique connection pair once. The count shows how many matching allowed firewall connection events were seen for each pair. Option A is not correct because the exhibit does not show sorting by destination IP hit count. Option C ignores the source and destination grouping. Option D would require grouping by source IP alone or by distinct destination counts per source, which is not the shown configuration.

The correct answer is D because Server A satisfies the rule’s threshold and count requirements, while Server B does not. The Study Guide explains that a FortiSIEM subpattern consists of Filter , Aggregate , and Group By components. It also states that the Aggregate function defines how many or what metric values must match during the time window, while Group By controls how the matching events are grouped into rows. The performance metrics lesson explains that FortiSIEM collects performance and availability data, converts polling results into logs, and uses those metrics for performance, availability, resource utilization, and baselining. In the exhibit, the aggregate evaluates CPU utilization against the device’s CPU critical threshold and also requires a matched-event count of at least two within the 10-minute window. Server A has CPU values above its critical threshold enough times in the window, so it generates one incident. Server B has a lower configured threshold but its collected CPU values do not satisfy the required aggregate condition for the grouped server. Therefore, only Server A generates an incident.

The user initiates an RDP session (Subpattern 1) and then fails to log in multiple times (Subpattern 2 with COUNT(Matched Events) > = 3) - both from the same Source IP and User within 300 seconds.

The brute force attempts typically involve a successful RDP connection followed by multiple failed logins, satisfying the sequence and grouping conditions in the rule.

The correct answers are A and B because the rule uses multiple subpatterns and requires them to occur in a defined relationship within the configured time window. The FortiSIEM Study Guide states that rule conditions specify the event attributes and thresholds that trigger the rule and create an incident. It also explains that the time window is the period “within which the subpattern(s) must match for the rule condition to be satisfied,” and that when there is more than one subpattern, FortiSIEM requires logic between the subpatterns plus subpattern relationship constraints. In the exhibit, the first subpattern detects an RDP connection and the second detects failed logons. The rule condition uses a sequence relationship, so the failed logon activity must follow the RDP connection and match the relationship constraints, such as same user and source IP. A user using RDP over SSL VPN who fails repeatedly satisfies this logic. A brute-force attack against an RDP server also satisfies the repeated failed-logon requirement after an RDP connection. Failing only twice does not meet the aggregate threshold, and connecting to the wrong IP is not the failed-logon sequence being detected.

The fields are highlighted in red because unique values such as Event Receive Time and Raw Event Log cannot be used in group-by operations. Grouping requires aggregatable or consistent values across events, while these fields are unique to each event, making them incompatible for grouping.

The correct answer is A because the highlighted fields are not valid for that grouped/aggregated display configuration. The FortiSIEM 7.4 User Guide notes that some event attributes, functions, and queries are not supported in specific analytics result-filter and display contexts. It lists date fields, including examples such as Event Receive Time , and also lists Raw Event Log and Binary Raw Event Log among unsupported fields for that context. The reason is practical: grouping requires stable values that can combine multiple events into meaningful grouped rows. Attributes such as Event Receive Time and Raw Event Log are highly specific to individual events. If every event has its own receive timestamp or unique raw log content, grouping by those fields defeats aggregation and can create one row per event rather than meaningful grouped output. COUNT(Matched Events) itself is a valid aggregate expression when used correctly. Event Receive Time is available in logs, but it is not appropriate as a grouped field in the configuration shown. Therefore, the red highlighting indicates invalid grouped fields caused by unique/non-groupable values.

The verified answer is D. Five . FortiSIEM grouping is based on unique combinations of the selected Group By fields. The Study Guide explains this behavior clearly: if multiple events have the same selected Group By values, “they are grouped together in one row,” and the count column tracks the number of events for each row. In this question, the selected fields are User and Count . The six raw rows contain these combinations: Mike/4, Bob/3, Alice/2, Alice/2, Bob/6, and Mike/5. Because Alice/2 appears twice, those two rows are grouped into a single result. The remaining combinations are unique. So FortiSIEM displays five grouped results, not six. Six would be correct only if every row had a unique User-and-Count combination, or if grouping included another differentiating attribute such as Source IP. Since the question specifically groups only by User and Count, duplicate User/Count pairs collapse into one row. Therefore, the correct result count is five .