Configure Machine Learning (ML) Configuration Tasks NSE6-FORTISIEM-ANALYST Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   An organization wants to stop using a specific ML-based anomaly detection feature because it generates too many false positives. What should the analyst do in FortiSIEM?

   • AChange the SIEM time zone to reduce alert volume
   • BDisable the specific ML feature in the ML configuration settings
   • CRemove the user accounts that trigger the false positives
   • DDelete all training data for the feature
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   In FortiSIEM ML configuration, what does the 'threshold' parameter control?

   • AThe sensitivity level at which an anomaly is flagged
   • BThe maximum number of log sources
   • CThe frequency of model retraining
   • DThe storage capacity for ML data
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A managed security service provider (MSSP) runs FortiSIEM for multiple tenants. One tenant, a retail company, has highly seasonal traffic patterns with massive spikes during holiday sales. The MSSP administrator is configuring ML for this tenant and wants to avoid the model flagging the seasonal spikes as anomalies. What is the most effective approach?

   • ADisable the ML feature during the holiday season and re-enable it after the sales period ends.
   • BSet a very high anomaly threshold to ensure that even the largest seasonal spikes do not trigger an alert.
   • CSchedule more frequent model updates during the holiday season to adapt to the changing patterns.
   • DConfigure the ML training data to include at least one full seasonal cycle, such as a full year, so the model learns the seasonal patterns as normal.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   In FortiSIEM, what is the purpose of the ML model update schedule?

   • ATo specify when reports are emailed
   • BTo determine when users can log in
   • CTo set the time for daily log backups
   • DTo define when the model is retrained with new data
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A university's IT team has deployed FortiSIEM ML to detect unusual network behavior on its student and faculty networks. The environment changes significantly at the start of each semester when new students enroll and course schedules change. The team wants the ML models to remain accurate without requiring manual intervention. What should the administrator configure?

   • AManually retrain the model only when a security incident is suspected.
   • BSet up a periodic schedule for ML model updates to retrain the models on a regular basis, such as weekly or monthly.
   • CDisable ML model updates to keep the baseline stable and consistent throughout the year.
   • DIncrease the learning rate to the maximum value so the model adapts instantly to any change.
   Reveal Solution Discussion Select an answer first