Configure Machine Learning (ML) Configuration Tasks NSE6-FORTISIEM-ANALYST Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   What type of information is typically displayed on the ML configuration status page in FortiSIEM?

   • AThe current CPU usage of the SIEM server
   • BThe list of all user passwords
   • CThe IP addresses of all network devices
   • DWhether ML models are currently running or have errors
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A small business is concerned about the resource consumption of running multiple ML features in FortiSIEM. They want to use ML for user behavior analytics but do not need network traffic anomaly detection at this time. What should the administrator do to meet this requirement?

   • AEnable all ML features and rely on the system to automatically optimize resource usage.
   • BEnable only the user behavior analytics ML feature and disable the network traffic anomaly detection feature.
   • CDisable all ML features to ensure no resources are consumed.
   • DEnable all ML features and then reduce the learning rate to minimize resource usage.
   Reveal Solution Discussion Select an answer first
4. 23application · easy

   A company is planning to deploy FortiSIEM ML for the first time. The security manager wants to understand the scope of what can be configured before implementation. Which statement accurately describes the purpose and scope of ML configuration tasks in FortiSIEM?

   • AML configuration tasks are only available to FortiSIEM super-admins and cannot be delegated to other roles.
   • BML configuration tasks are limited to enabling or disabling the overall ML module, with no granular control over individual features.
   • CML configuration tasks allow administrators to enable or disable specific ML features, set model parameters, and manage training data and schedules.
   • DML configuration tasks are primarily for viewing ML-generated alerts and do not involve any setup or tuning.
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A security operations center (SOC) is using FortiSIEM's ML-based user behavior analytics to detect compromised accounts. The team has noticed that the model is generating too many alerts for normal after-hours activity by system administrators. The analysts want the model to focus on genuinely anomalous behavior without disabling the feature entirely. Which configuration change should the administrator make?

   • AReduce the learning rate to make the model adapt more slowly to new normal behavior patterns.
   • BIncrease the anomaly threshold so that only more significant deviations from the learned baseline trigger alerts.
   • CDisable the ML feature for system administrator accounts to stop all alerts for that user group.
   • DShorten the time window for the ML model to evaluate user activity.
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   A FortiSIEM administrator has scheduled ML model updates to run nightly. The administrator notices that the model's status is 'Failed' after the last update, and no new alerts are being generated. What is the most likely cause of this issue?

   • AThe ML feature was disabled during the update process.
   • BThe learning rate was set too low, preventing the model from updating its baseline.
   • CThe data source used for retraining is temporarily unavailable, causing the update to fail.
   • DThe anomaly threshold was set too high, preventing the model from completing the update.
   Reveal Solution Discussion Select an answer first