NSE6_FSM_AN-7.4 Fortinet NSE 6 - FortiSIEM 7.4 Analyst Question and Answers

The correct answers are D. Run Remediation/Script and E. Run Playbook on Incident Trigger . FortiSIEM can block an IP address on a FortiGate through a remediation script or through a FortiSOAR playbook/connector workflow. The FortiSIEM Analyst Study Guide explains that for automatic remediation, you define a remediation script for a scenario, and that mitigation scripts can “block an IP address in a firewall” or disable a user in Active Directory. It also states that, when an automation policy is triggered and the remediation script option is enabled, FortiSIEM uses incident data and runs the script to quarantine or block the offending IP address on FortiGate.

FortiSIEM 7.4 also supports automatic playbook execution from an automation policy. The 7.4 User Guide states that under Admin > Settings > Automation Policy , you can choose Run Playbook on Incident Trigger and select a playbook. The same guide explains that FortiSOAR playbooks can call connectors, and the Fortinet FortiOS connector can perform actions such as Block IP Address on a FortiGate firewall.

Email, Remedy tickets, and generic integration policies are notification/ticketing workflows, not the direct FortiGate IP-block actions.

The user initiates an RDP session (Subpattern 1) and then fails to log in multiple times (Subpattern 2 with COUNT(Matched Events) > = 3) - both from the same Source IP and User within 300 seconds.

The brute force attempts typically involve a successful RDP connection followed by multiple failed logins, satisfying the sequence and grouping conditions in the rule.

The correct answers are A and B because the rule uses multiple subpatterns and requires them to occur in a defined relationship within the configured time window. The FortiSIEM Study Guide states that rule conditions specify the event attributes and thresholds that trigger the rule and create an incident. It also explains that the time window is the period “within which the subpattern(s) must match for the rule condition to be satisfied,” and that when there is more than one subpattern, FortiSIEM requires logic between the subpatterns plus subpattern relationship constraints. In the exhibit, the first subpattern detects an RDP connection and the second detects failed logons. The rule condition uses a sequence relationship, so the failed logon activity must follow the RDP connection and match the relationship constraints, such as same user and source IP. A user using RDP over SSL VPN who fails repeatedly satisfies this logic. A brute-force attack against an RDP server also satisfies the repeated failed-logon requirement after an RDP connection. Failing only twice does not meet the aggregate threshold, and connecting to the wrong IP is not the failed-logon sequence being detected.

The correct syntax is COUNT(Matched Events) - with proper capitalization and spacing - to generate a total count of matched events. The error in the exhibit likely stems from a formatting issue (e.g., lowercase count() or incorrect spacing), not the logical structure of the expression.

COUNT(Matched Events) . FortiSIEM uses aggregate functions inside rule subpatterns and analytics display fields to calculate values such as the number of matched events. The Study Guide explains that rule conditions are built from subpatterns of event attribute filters and aggregation functions. It also shows that the Aggregate section is where expressions such as COUNT(Matched Events) are used to define event-count thresholds. In the exhibit, the expression is intended to generate a total count of matched events. The proper function format is the aggregate function name followed by the target field inside parentheses. Therefore, COUNT(Matched Events) is syntactically valid. Options B, C, and D are invalid because they place the function name outside the standard function-call format or attach the argument incorrectly. This matters because FortiSIEM’s Expression Builder validates expressions according to function syntax. To count matched events, the function must be written as an aggregate operation over the Matched Events field.

When an associated rule triggers, FortiSIEM performs all selected actions in the automation policy. In this case, it will send an email/SMS/webhook, run the remediation script, invoke the integration policy (even if none is currently defined), and create a case. All checked actions are executed.

The correct answer is B because FortiSIEM automation policies are designed to execute the actions selected in the policy when the policy criteria match. The FortiSIEM Study Guide states that automation policy actions define what occurs when policy criteria match. It lists possible automation actions such as sending an alert, invoking an integration policy, sending SNMP or HTTPS XML notifications, opening a remedy ticket or creating a FortiSIEM case, sending email or SMS, and running a remediation script. The same Study Guide explains that users can configure “any combination of actions.” Therefore, there is no single-action precedence rule where remediation overrides all other selected actions or email runs only because it appears first. If multiple action checkboxes are selected, FortiSIEM executes the configured selected actions according to the automation policy. In the exhibit, multiple actions are selected, including email/SMS/webhook, remediation/script, integration policy, and case creation. Option C is incorrect because the absence of a defined integration policy does not make FortiSIEM ignore the other selected actions. The policy runs the selected configured actions.

Grouping by User, Source IP, and Count means that each unique combination of those three attributes will be treated as a separate result. In the table, all six rows have distinct combinations of User, Source IP, and Count - so FortiSIEM will display 6 results.

Six because grouping by User , Source IP , and Count creates a separate result for every unique combination of those three selected attributes. The FortiSIEM Study Guide explains this grouping behavior in the single-subpattern rule example: “If multiple VPN login failure events have the same source IP address, reporting device, reporting IP address, and user, they are grouped together in one row, and the count column tracks the number of events for each of those rows.” Applying that rule here, FortiSIEM compares all selected Group By fields together. In the exhibit, every row has a unique Source IP address, even where the same user appears more than once. For example, Mike appears twice, but the Source IP and Count values are different. Alice appears twice with Count 2, but the Source IP values are different. Bob appears twice, but both Source IP and Count are different. Since no row has the same User, Source IP, and Count combination as another row, FortiSIEM displays all six rows.

FortiSIEM grouping works by combining events that have the same values for all selected Group By attributes. The Study Guide’s rule and subpattern example states that when multiple events have the same Group By values, “they are grouped together in one row, and the count column tracks the number of events for each of those rows.” In the exhibit, the selected grouping fields are Reporting Device, Reporting IP, and Application Category. The table contains six raw rows, but two rows share the same grouped combination: FW01 / 10.1.1.1 / DB . Those two rows are collapsed into one grouped result. The other combinations are unique: FW02 / 10.1.1.2 / WebApp, FW01 / 10.1.1.1 / SSH, FW03 / 10.1.1.3 / DB, and FW04 / 10.1.1.4 / SSH. That creates five grouped rows in total. FortiSIEM does not display six because grouping removes duplicate combinations, and it does not display four because only one duplicate combination exists.

The correct answer is D. ZTNA tags. FortiSIEM 7.4 includes FortiEMS endpoint tagging integration. The FortiSIEM 7.4 User Guide states that FortiSIEM supports discovery of FortiEMS servers by using the FortiEMS Management Server API with basic username/password authentication. It also explains that after FortiEMS discovery, FortiSIEM can tag or untag a host by using classification tags on the FortiEMS server. In a ZTNA deployment, those tags are imported by member Fortinet devices, especially FortiGate firewalls, and are referenced in ZTNA firewall rules. The guide gives a common use case in which a host is tagged as suspicious or potentially compromised so firewall rules can isolate it or allow only minimal traffic. Host software versions, FortiSIEM license information, and host login credentials are not the FortiEMS API information relevant to this ZTNA tagging workflow. The API integration supports retrieving FortiEMS-managed host context and using classification/ZTNA tags for automated response and policy enforcement.

The correct answer is A. FortiSIEM agent. The FortiSIEM Study Guide identifies FortiSIEM agents as the component responsible for “file, log monitoring, and UEBA.” It also explains that FortiSIEM agents can be installed on endpoints or servers to provide data collection functions that native syslog may not provide. For Windows systems specifically, the guide states that Windows servers do not natively send syslog messages and that a FortiSIEM Windows agent can be installed to perform that function. The FortiSIEM 7.4 User Guide also confirms that FortiInsight UEBA functionality runs as an integrated module within the FortiSIEM Windows Agent in newer releases. SSH and SNMP are access or monitoring protocols; they can support discovery or performance monitoring, but they are not the UEBA data-sending component. A FortiSIEM worker performs analysis and search functions inside the FortiSIEM architecture; it is not installed on endpoints to collect UEBA telemetry. Therefore, the FortiSIEM agent is the correct mechanism for sending UEBA-relevant endpoint data to FortiSIEM.

The correct answer is D. The exhibit shows an outer event query using the Event Attribute filter Source IP NOT IN Device IP: Approved Devices. The outer query time range is set to Relative — Last 10 Minutes, so FortiSIEM searches only the event data from the last 10 minutes. The exhibit also shows a separate Nested Time Range set to Relative — Last 30 Days. In FortiSIEM nested searches, the nested time range applies to the inner report/subquery, not to the outer event search. The FortiSIEM 7.4 User Guide states that nested query functionality lets one query refer to results from another query, and for outer event / inner event nested searches, it instructs the user to “choose the time range for outer query” and separately “choose Nested Time Range for the inner query.” It also states that when an existing query is used as an inner query, “time range would be set separately” in the outer query configuration. Therefore, FortiSIEM searches the last 10 minutes of outer events and compares their Source IP values against the Device IP values returned by the Approved Devices report using the last 30 days nested time range.

FortiSIEM supports both global thresholds and per-device/per-device-object thresholds for some performance events. The Study Guide states that FortiSIEM can define “per-device-object thresholds or global thresholds” for performance events, and separately explains that global thresholds are referenced by the rules engine by default. Therefore, the correct statement is that FortiSIEM uses global and per-device thresholds for performance metrics. Options A, B, and D are too restrictive or false because FortiSIEM does not use only one fixed threshold model.

The correct answer is A. A configuration management database (CMDB) device group . In the exhibit, the analytics filter uses Source IP IN Group: VPN Gateway . In FortiSIEM analytics, values shown as Group: for IP/device-related attributes commonly reference FortiSIEM CMDB groups, not firewall address groups or rule folders. The FortiSIEM 7.4 User Guide explains how CMDB groups are inserted into queries: to add a CMDB group, the user selects an attribute, selects an operator such as IN , and then selects a value from CMDB. The guide gives a direct example where a reporting IP is matched using a firewall device group, expressed as a condition equivalent to “reptDevIpAddr IN Firewall group.”

This matches the exhibit’s structure: Source IP is the event attribute, IN is the operator, and Group: VPN Gateway is the selected CMDB group value. A FortiSIEM watchlist is different; the Study Guide describes watchlists as containers of similar items that can be referenced in searches, rules, and reports, but they are managed under Resources > Watch Lists, not shown here as a CMDB-style device group value. A FortiGate address group exists on FortiGate, not as this FortiSIEM analytics CMDB group reference.