NSE6_FSM_AN-7.4 Fortinet NSE 6 - FortiSIEM 7.4 Analyst Question and Answers

The correct answer is A . In FortiSIEM machine learning training, the Train factor controls how much of the prepared dataset is used for training and how much is reserved for testing. The FortiSIEM 7.4 User Guide states in the regression training procedure that the analyst must choose the Train factor and that it “should be greater than 70%.” It also explains the meaning of the value: 70% of the data is used for training and 30% is used for testing. This directly supports option A. Option B is incorrect because the supported running modes include Local, Local Auto, and AWS; “ML” is not the required run mode. Option C is incorrect because regression can use multiple fields for prediction; the guide instructs the user to choose the fields to use for prediction and the field to predict. Option D is incorrect because prediction input fields and target field should not be the same. Regression builds a model to predict a target field based on other fields, so the configuration must use a valid Train factor rather than matching predictor and target fields.

The correct answer is D. The exhibit shows an outer event query using the Event Attribute filter Source IP NOT IN Device IP: Approved Devices. The outer query time range is set to Relative — Last 10 Minutes, so FortiSIEM searches only the event data from the last 10 minutes. The exhibit also shows a separate Nested Time Range set to Relative — Last 30 Days. In FortiSIEM nested searches, the nested time range applies to the inner report/subquery, not to the outer event search. The FortiSIEM 7.4 User Guide states that nested query functionality lets one query refer to results from another query, and for outer event / inner event nested searches, it instructs the user to “choose the time range for outer query” and separately “choose Nested Time Range for the inner query.” It also states that when an existing query is used as an inner query, “time range would be set separately” in the outer query configuration. Therefore, FortiSIEM searches the last 10 minutes of outer events and compares their Source IP values against the Device IP values returned by the Approved Devices report using the last 30 days nested time range.

The correct answer is B because the configuration groups results by Source IP and Destination IP , while using COUNT(Matched Events) as a display/aggregate value. FortiSIEM’s grouping logic combines events only when the selected Group By attributes match. The Study Guide explains that Group By attributes determine how matching events are placed into rows, and that when multiple events share the same grouped values, “they are grouped together in one row.” The count column then tracks the number of events represented by that row. In the exhibit, Source IP and Destination IP are the grouping fields, so FortiSIEM displays each unique connection pair once. The count shows how many matching allowed firewall connection events were seen for each pair. Option A is not correct because the exhibit does not show sorting by destination IP hit count. Option C ignores the source and destination grouping. Option D would require grouping by source IP alone or by distinct destination counts per source, which is not the shown configuration.

The correct answers are A. Email and B. FortiSIEM Case. FortiSIEM automation policies can notify or route work to analysts when an incident is triggered. The Study Guide describes the incident notification email workflow and explains that when an incident triggers and an automation policy is defined, FortiSIEM can send a notification email using the default template. It also explains that notification frequency is configured per rule and that repeated incident notifications are controlled by the frequency timer. The FortiSIEM 7.4 User Guide also describes automated case creation through automation policy. It states that an automation policy can use the action Create Case when an incident is created, and that a case management policy can assign FortiSIEM Analyst Teams in an ordered handling sequence. Syslog is not listed as one of the analyst notification methods in the automation policy options shown in this question; FortiSIEM supports SNMP and webhook-style actions, but not “Syslog” as the listed answer. A pop-up window is not an automation policy notification method. Therefore, the two correct analyst-notification/routing methods are Email and FortiSIEM Case.

The search fails because nested analytics queries require the outer query attribute type to match the inner query display-column data type. The FortiSIEM Study Guide explicitly explains this rule in the Nested Query section: “Another important aspect to understand is that the data value types must match.” It further explains that each inner query display column has a data value type, such as IP, string, or integer, and the outer query attribute must match that type. The FortiSIEM 7.4 User Guide states the same operational requirement: for a nested query to work correctly, “the data type of the filter attribute in the outer query must match up with the data type of one certain display column in the inner query.” Therefore, if the inner query returns a string attribute but the outer query compares it against an IP-type attribute, FortiSIEM cannot produce a valid match. The issue is not the time range, not the use of User and Event Type together, and not the Boolean operator. It is an attribute type mismatch between the query and subquery.

The correct answer is D. ZTNA tags. FortiSIEM 7.4 includes FortiEMS endpoint tagging integration. The FortiSIEM 7.4 User Guide states that FortiSIEM supports discovery of FortiEMS servers by using the FortiEMS Management Server API with basic username/password authentication. It also explains that after FortiEMS discovery, FortiSIEM can tag or untag a host by using classification tags on the FortiEMS server. In a ZTNA deployment, those tags are imported by member Fortinet devices, especially FortiGate firewalls, and are referenced in ZTNA firewall rules. The guide gives a common use case in which a host is tagged as suspicious or potentially compromised so firewall rules can isolate it or allow only minimal traffic. Host software versions, FortiSIEM license information, and host login credentials are not the FortiEMS API information relevant to this ZTNA tagging workflow. The API integration supports retrieving FortiEMS-managed host context and using classification/ZTNA tags for automated response and policy enforcement.

The attribute must be selected as a Triggered Attribute so that it becomes available for incident generation and incident-title substitution. In the FortiSIEM Study Guide’s rule action configuration section, FortiSIEM separates incident attributes from triggered attributes. Triggered attributes are taken from the events that cause the rule to trigger and are then available for incident display and incident context. The guide explains that the rule action step is where an analyst defines the incident generated by a rule and chooses which attributes are carried forward. If Destination Host Name is not selected in the Triggered Attributes list, FortiSIEM cannot use it as an incident attribute in the generated incident title. Option B is wrong because aggregate items are used for calculations such as COUNT, AVG, or SUM, not for making a text attribute available in the incident title. Option C is wrong because Destination Host Name is an event attribute, not an event type. Option D is unrelated; removing Destination IP would not make Destination Host Name selectable.

To detect three failed login attempts within three minutes, you must set the aggregate count to 3 in the subpattern and the time window to 180 seconds in the rule condition. This ensures the rule triggers only if three or more failed logins occur in that timeframe.

The correct answer is A because three minutes equals 180 seconds, and the aggregate threshold must be set to three matching events. The FortiSIEM Study Guide explains that rule conditions specify event attributes and thresholds that trigger the rule and create an incident. It further states that the time window defines the period within which the subpattern must match for the rule condition to be satisfied. The Study Guide’s single-subpattern rule example shows the same principle: the condition has a configured time window, and the Aggregate section uses a function such as COUNT(Matched Events) to require a minimum number of matching events. In this question, the analyst wants the rule to trigger when three failed login attempts happen within three minutes . Therefore, the rule condition time window must be 180 seconds , and the aggregate count must be 3 . A 90-second window would detect only events inside one and a half minutes, not the required three minutes. An aggregate count of 2 would trigger too early because the requirement is three failed attempts.

The rule is triggering on successful RDP connection events because the Next operator between the two subpatterns is set to OR . The FortiSIEM Study Guide explains that multiple subpattern rules are used when patterns must occur within a specific time period or when one of several patterns proves that an incident condition exists. It lists the OR operator as: “Subpattern X OR Subpattern Y occurred within the Time Window.” The same Study Guide further explains that if multiple patterns are used, FortiSIEM requires a next operator, and in the OR example, “an event that matches either” subpattern will trigger. It also states that because the next operator is OR, the constraint between the two subpatterns is not enforced.

In the exhibit, Subpattern 1 matches RDP traffic on TCP/UDP port 3389 from FortiGate traffic-forward events, while Subpattern 2 matches logon failure events with COUNT(Matched Events) > = 3. Because the rule uses OR, FortiSIEM can trigger when only the RDP connection subpattern matches, even if the failed-logon subpattern does not match. The correct logic should require both subpatterns to match with the intended relationship constraints, not either subpattern independently.

FortiSIEM supports both global thresholds and per-device/per-device-object thresholds for some performance events. The Study Guide states that FortiSIEM can define “per-device-object thresholds or global thresholds” for performance events, and separately explains that global thresholds are referenced by the rules engine by default. Therefore, the correct statement is that FortiSIEM uses global and per-device thresholds for performance metrics. Options A, B, and D are too restrictive or false because FortiSIEM does not use only one fixed threshold model.

FortiSIEM applies tags to FortiClient EMS-managed hosts through FortiEMS integration. The FortiSIEM 7.4 User Guide states that FortiSIEM supports discovery of FortiEMS servers using the FortiEMS Management Server API with username/password authentication. That supports option A: FortiEMS API credentials must be configured on FortiSIEM. The same guide explains that after FortiEMS discovery, “FortiSIEM can tag or untag a host, using classification tags on FortiEMS server.” It further explains the ZTNA workflow: in ZTNA, these tags are imported by Fortinet devices, especially FortiGate firewalls, and referenced in ZTNA firewall rules. That supports option C: the tag value used for ZTNA classification must be available/defined for the FortiEMS tagging workflow. Option B is not the best required configuration in the question because a remediation script is an execution method, not one of the two foundational settings being asked for. Option D reverses the API relationship; FortiSIEM connects to FortiEMS using FortiEMS credentials, not FortiSIEM API credentials stored on EMS.