Configure Notification Policies NSE6-FORTISIEM-ANALYST Practice Questions (Page 1)

Questions 1–5

1. 1expert · medium

   A FortiSIEM administrator is configuring a notification policy that sends an SNMP trap to a network operations center (NOC) when a router's interface goes down. The administrator has configured the trigger and the SNMP action, but the NOC reports they are not receiving the trap. The administrator uses the Test button and the test trap is successfully received by the NOC. What is the most likely reason the real trap is not being sent?

   • AThe NOC's SNMP receiver is blocking traps from the FortiSIEM server.
   • BThe trigger conditions do not match the actual interface-down events generated by the router.
   • CThe notification policy is disabled.
   • DThe SNMP action is configured with the wrong community string.
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   Which of the following is a valid notification action in FortiSIEM?

   • ACreate a new user account
   • BExecute a PowerShell script
   • CReboot a server
   • DSend an email
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   What happens to an existing notification policy when you edit its trigger conditions?

   • AThe policy is duplicated and the original is kept unchanged
   • BThe policy's notification history is deleted
   • CThe policy is disabled until you re-enable it
   • DThe policy is immediately applied with the new conditions
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A financial institution's FortiSIEM administrator is configuring a notification policy for failed login attempts on a critical database server. The compliance team requires a verifiable record of each notification sent, and the network team wants to receive the notification in their existing SIEM console. The administrator has already created the policy with a trigger for authentication failures. Which action configuration best satisfies both requirements?

   • ACreate two separate notification policies with identical triggers, one with an email action and one with a syslog action.
   • BAdd both an email action and a syslog action to the same notification policy, with the email sent to the compliance team and the syslog forwarded to the network team's SIEM.
   • CAdd only an email action and send it to the compliance team; the network team can view the same email in a shared mailbox.
   • DAdd only a syslog action and forward it to the network team's SIEM; the compliance team can query the SIEM for the record.
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   What is the purpose of testing a notification policy in FortiSIEM?

   • ATo verify that notifications are generated and delivered correctly
   • BTo measure the performance impact of the policy on the system
   • CTo check if the policy is compliant with regulatory standards
   • DTo determine the optimal severity threshold for the policy
   Reveal Solution Discussion Select an answer first