Free Fortinet NSE6_FSM_AN-7.4 Practice Exam with Questions & Answers | Set: 2

The operator is set to " = " , which performs an exact match on the entire raw event log, not a substring search. To find logs that contain the keyword " udp " , the analyst should use the CONTAIN operator instead. This will return all logs where " udp " appears anywhere in the raw log message.

The correct answer is D because the analyst is trying to search for raw logs that contain the keyword udp, but the filter uses the equality operator. The FortiSIEM Study Guide explains keyword searches in terms of Raw Event Log CONTAIN logic. In the keyword phrase search section, the guide states that without quotes, FortiSIEM searches raw event logs by using conditions such as Raw Event Log CONTAIN TCP OR Raw Event Log CONTAIN connection . Another analytics example explains that searching for TCP or UDP events uses the raw event log containing the keyword tcp or udp and that the search returns case-insensitive results for TCP and UDP. This directly eliminates option C. The time range is already set to the last two hours, which is correct for historical raw log searching. The problem is the operator. To find a keyword anywhere inside a raw log message, the analyst should use CONTAIN , not =.

The automation policy is configured to run a remediation script named " Fortinet FortiOS - Block Source IP FortiOS via API " . It specifies enforcement on two FortiGate devices: FortiGate508 and FortiGate90D. Therefore, associated source IP addresses will be blocked on those two FortiGate firewalls only.

The correct answer is D because the remediation configuration defines specific enforcement targets. The FortiSIEM Study Guide explains that automation policies can run remediation scripts automatically when an incident occurs. It also explains the remediation options: Enforce On determines which devices the script runs against, while Run On identifies whether the script is launched from the supervisor or a collector. The Study Guide further states that mitigation scripts can block an IP address in a firewall or disable a user in Active Directory, and recommends specifying the Enforce On value because it controls the target device used by the remediation script. In the exhibit, the selected script is a Fortinet FortiOS block-source-IP remediation script, and the Enforce On field lists two FortiGate devices. That means the block action is targeted only at those two named FortiGate firewalls. The Aviation organization limits the automation policy context, but it does not mean every device in the organization receives the block. It is also not all FortiGate firewalls or the whole Network CMDB group.

The Aggregate section contains the condition COUNT(Matched Events) > = 1, which defines how many events must match the filter criteria for the rule to trigger. This is the subpattern configuration that determines the event threshold.

The correct answer is A. Aggregate . In FortiSIEM rule subpatterns, the Filter section defines which events are eligible for matching, but the Aggregate section defines the statistical or threshold condition that must be satisfied before the subpattern is considered matched. The Study Guide explains that rule conditions are built from subpatterns of event attribute filters and aggregation functions. It also states that a single-subpattern rule is formed by three fields: filters, aggregate, and group by. In the exhibit, the aggregate line is COUNT(Matched Events) > = 1. That expression directly specifies the number of matching events required to satisfy the subpattern. Group By only controls how matching events are partitioned into separate evaluation groups. Actions define what happens after a rule triggers, such as incident generation or notification. Filters define the event type or attribute criteria, but they do not define the required count threshold. Therefore, the section that determines how many matching events are needed is the Aggregate section.

The correct answer is D because Server A satisfies the rule’s threshold and count requirements, while Server B does not. The Study Guide explains that a FortiSIEM subpattern consists of Filter , Aggregate , and Group By components. It also states that the Aggregate function defines how many or what metric values must match during the time window, while Group By controls how the matching events are grouped into rows. The performance metrics lesson explains that FortiSIEM collects performance and availability data, converts polling results into logs, and uses those metrics for performance, availability, resource utilization, and baselining. In the exhibit, the aggregate evaluates CPU utilization against the device’s CPU critical threshold and also requires a matched-event count of at least two within the 10-minute window. Server A has CPU values above its critical threshold enough times in the window, so it generates one incident. Server B has a lower configured threshold but its collected CPU values do not satisfy the required aggregate condition for the grouped server. Therefore, only Server A generates an incident.