Configure Machine Learning (ML) Configuration Tasks NSE6-FORTISIEM-ANALYST Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   What is a common cause of ML configuration issues in FortiSIEM?

   • AInsufficient training data for the model to learn from
   • BSlow internet connection
   • CToo many users in the system
   • DIncorrect firewall rule order
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   A FortiSIEM administrator has enabled ML-based anomaly detection for a subset of users. After 24 hours, the ML configuration status page shows the model status as 'Training' but no alerts are being generated. The administrator has verified that the data sources are forwarding events correctly. What is the most likely cause of this issue?

   • AThe anomaly threshold is set too low, preventing any event from being flagged as anomalous.
   • BThe model is still in its initial learning phase and requires more data to establish a reliable baseline before it can generate alerts.
   • CThe ML feature is disabled for the specific user group that was selected.
   • DThe time window for the ML model is configured to be too short, so it has not yet collected enough events.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   An ML model in FortiSIEM is not generating any alerts even though anomalies exist. What is a common first step to troubleshoot this issue?

   • ACheck if the ML feature is enabled and the model is running
   • BChange the SIEM time zone
   • CDelete all training data
   • DReboot the SIEM server
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   Which domain of FortiSIEM functionality is directly supported by the ML configuration tasks?

   • ANetwork topology discovery
   • BUser and Entity Behavior Analytics (UEBA)
   • CVulnerability scanning
   • DLog archival and retention
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   A large enterprise has deployed FortiSIEM ML for user behavior analytics. The model has been running for several months and is now generating very few alerts. The security team suspects that the model has become too accustomed to a slowly evolving attack pattern that blends in with normal activity. Which parameter adjustment would be most effective in making the model more sensitive to subtle deviations?

   • AExtend the time window for the model to analyze user activity.
   • BLower the anomaly threshold to require a smaller deviation from the baseline to trigger an alert.
   • CRetrain the model using only the most recent month of data.
   • DIncrease the learning rate so the model updates its baseline more quickly.
   Reveal Solution Discussion Select an answer first