Configure FortiSIEM Analytics Rules NSE6-FORTISIEM-ANALYST Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   A security team has a rule that triggers on 'Malware Detected' events. The rule currently triggers on any detection, but the team wants to prioritize alerts for critical systems. They want to be notified immediately for malware on servers, but only receive a daily summary for malware on workstations. Which approach is most effective?

   • ACreate a single rule for all devices and manually filter the alerts in the console.
   • BCreate two rules: one for servers with an immediate email action, and one for workstations with a daily summary action.
   • CCreate a single rule for all devices with an immediate email action.
   • DCreate a single rule for all devices with a daily summary action.
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   A large enterprise has a rule that triggers on 'Login Failure' events. The rule currently uses a threshold of 5 failures in 10 minutes. The security team is experiencing a high volume of false positives because a single user with a mistyped password triggers the rule. They want to reduce false positives while still detecting brute-force attacks. Which modification is most effective?

   • AIncrease the threshold to 10 failures in 10 minutes.
   • BAdd a condition that the login failures are from the same source IP address.
   • CChange the rule to trigger on 'Account Lockout' events instead of 'Login Failure' events.
   • DReduce the time window to 5 minutes.
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   In a FortiSIEM analytics rule, which section is used to define the response that occurs after the rule's conditions are met?

   • ARule attributes
   • BRule actions
   • CRule conditions
   • DRule schedule
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   When configuring an analytics rule in FortiSIEM, which component defines the specific event pattern that triggers the rule?

   • ARule group
   • BRule actions
   • CRule attributes
   • DRule conditions
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A company wants to be alerted when a specific user account is used to log in from two different countries within a 30-minute period. Which rule configuration is appropriate?

   • AUse a 'Baseline' condition that learns the user's typical countries and triggers on a new one.
   • BUse a 'Static List' condition that contains the user's allowed countries and triggers if the login country is not in the list.
   • CUse a 'Correlation' condition that matches two login events from the same user with different countries within 30 minutes.
   • DUse a 'Threshold' condition that counts logins from different countries and triggers if the count exceeds 2.
   Reveal Solution Discussion Select an answer first