Configure Notification Policies NSE6-FORTISIEM-ANALYST Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   When creating a new notification policy in FortiSIEM, which fields are mandatory?

   • ADescription and trigger conditions
   • BName and description
   • CName and recipient email address
   • DName only
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   Which of the following can be a recipient of a FortiSIEM notification action?

   • AAn email address
   • BA storage volume
   • CA network subnet
   • DA FortiSIEM user role
   Reveal Solution Discussion Select an answer first
4. 13expert · medium

   A FortiSIEM administrator is creating a notification policy for a new security monitoring initiative. The policy should notify the security team when a new user account is created on a domain controller. The administrator wants to test the policy without waiting for a real user account creation event. What is the best way to test the policy?

   • AReview the policy's configuration to ensure the trigger and action are correct.
   • BUse the Test button in the notification policy editor to send a test notification.
   • CEnable the policy and wait for the next real user account creation event.
   • DCreate a test user account on the domain controller to trigger the policy.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   How can you test a notification policy in FortiSIEM?

   • ABy restarting the FortiSIEM collector service
   • BBy changing the policy's severity threshold
   • CBy disabling and re-enabling the policy
   • DBy generating a test event that matches the policy's trigger conditions
   Reveal Solution Discussion Select an answer first
6. 15expert · medium

   A FortiSIEM administrator is responsible for a notification policy that sends an email to the security team when a malware signature update fails. The policy has been working for months, but the security team reports they have not received any emails in the past two weeks. The administrator checks the policy and finds it is enabled, the trigger conditions are unchanged, and the SMTP server is working. What is the most likely cause of the issue?

   • AThe notification policy was disabled by another administrator.
   • BThe security team's email addresses were removed from the recipient list.
   • CThe malware signature update process has not failed in the past two weeks.
   • DThe notification policy's email action was accidentally removed.
   Reveal Solution Discussion Select an answer first