Configure Notification Policies NSE6-FORTISIEM-ANALYST Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   In a notification policy, what is the role of a 'condition'?

   • AIt defines the action to take when a notification is triggered
   • BIt specifies the criteria that an event or incident must meet to trigger the notification
   • CIt determines the recipients of the notification
   • DIt sets the frequency of notification delivery
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   In FortiSIEM, what is the primary purpose of a notification policy?

   • ATo control user access permissions to the FortiSIEM GUI
   • BTo store historical event data for compliance reporting
   • CTo automatically remediate security incidents by executing scripts
   • DTo define when and how alerts are sent for matching events or incidents
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   What is the impact of deleting a notification policy in FortiSIEM?

   • AThe policy's notification history is archived
   • BThe policy is moved to a recycle bin and can be restored
   • CThe policy is disabled but its configuration is retained
   • DThe policy is permanently removed and no longer generates notifications
   Reveal Solution Discussion Select an answer first
5. 9expert · medium

   A FortiSIEM administrator manages a notification policy that alerts on brute-force SSH attempts. The policy was recently modified to include a new trigger condition that checks for a specific source IP range. After the change, the SOC reports that they are no longer receiving notifications for brute-force attempts from other source IPs. The administrator confirms the policy is enabled and the email action is correctly configured. What is the most likely cause of the missing notifications?

   • AThe SMTP server is now blocking emails from FortiSIEM.
   • BThe notification policy was disabled during the modification and not re-enabled.
   • CThe email action's recipient list was accidentally cleared during the modification.
   • DThe new trigger condition is too restrictive, filtering out events that previously matched.
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A logistics company's FortiSIEM administrator is updating a notification policy that alerts on failed VPN authentication attempts. The policy currently sends an email to the IT helpdesk. The security manager wants the notification to also be sent to the security team's incident response (IR) mailbox. What is the most efficient way to update the policy?

   • ACreate a new notification policy with the same trigger and an email action to the IR mailbox.
   • BEdit the existing email action and add the IR mailbox to the recipient list.
   • CDisable the existing policy and create a new one with both recipients.
   • DChange the existing email action to send to the IR mailbox and remove the helpdesk.
   Reveal Solution Discussion Select an answer first