Configure Machine Learning (ML) Configuration Tasks NSE6-FORTISIEM-ANALYST Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A financial services company is deploying FortiSIEM's ML-based anomaly detection. The security team wants the model to learn normal behavior for their finance department users. They have a large volume of historical authentication and VPN logs, but they are concerned that including data from a recently completed merger might skew the baseline. What should the administrator do to ensure the model trains on the most relevant data?

   • ADisable the ML feature for the finance department until the merger data is no longer in the system.
   • BSelect only the data sources and time range that correspond to the current finance department users, excluding the merger period.
   • CInclude all historical data to give the model the largest possible sample size for a more accurate baseline.
   • DEnable the ML feature and let the model automatically determine which data is relevant for training.
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   What is the purpose of managing training data in FortiSIEM ML configuration?

   • ATo select which data sources the ML model uses to learn normal behavior
   • BTo set user permissions for data access
   • CTo configure firewall rules for data sources
   • DTo delete old logs from the SIEM database
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   Where can an analyst check the current status and health of ML models in FortiSIEM?

   • AIn the ML configuration status page
   • BIn the user management console
   • CIn the firewall policy editor
   • DIn the log viewer
   Reveal Solution Discussion Select an answer first
5. 4application · easy

   A new SOC analyst needs to review the current ML configuration to understand which features are active and their status. The analyst has access to the FortiSIEM web interface but is unfamiliar with the menu structure. Where should the analyst navigate to find the ML configuration settings?

   • ANavigate to the 'Reports' section and choose 'ML Configuration' from the report templates.
   • BNavigate to the 'Events' page and click on the 'ML Status' icon in the toolbar.
   • CNavigate to the 'Analytics' tab and select 'ML Models' from the drop-down list.
   • DNavigate to the 'Admin' section and select 'Machine Learning' from the settings menu.
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   After enabling ML-based anomaly detection, a FortiSIEM administrator notices that the model's training status has been stuck on 'Training' for several days, and no alerts are being generated. The administrator has confirmed that the data sources are sending events. What is the most likely cause of this issue?

   • AThe selected training data sources are not generating enough events to complete the initial training phase.
   • BThe time window for the ML model is configured to be too long, delaying the training process.
   • CThe anomaly threshold is set too high, preventing the model from completing its training.
   • DThe ML feature is disabled for the user group that was selected for training.
   Reveal Solution Discussion Select an answer first