Configure Notification Policies NSE6-FORTISIEM-ANALYST Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   Which of the following are core components of a FortiSIEM notification policy?

   • ATriggers, conditions, and actions
   • BDevices, collectors, and agents
   • CRules, reports, and dashboards
   • DUsers, roles, and permissions
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   What does an SNMP trap action do in a FortiSIEM notification policy?

   • AIt sends an alert message to an SNMP management system
   • BIt triggers a webhook to a REST API
   • CIt logs the event to the local syslog file
   • DIt updates the FortiSIEM database with the event details
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A FortiSIEM administrator has just created a notification policy that sends an SNMP trap to a network monitoring system when a specific device goes offline. Before enabling the policy for production, the administrator wants to confirm that the trap is correctly formatted and reaches the monitoring system. Which action should the administrator take?

   • AReview the notification policy's audit log to see if the policy has ever fired.
   • BCheck the policy's trigger conditions to ensure the device-offline event is correctly defined.
   • CEnable the policy and wait for the next real device-offline event to confirm the trap is received.
   • DUse the 'Test' button in the notification policy editor to send a test notification and verify the trap is received by the monitoring system.
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   Which of the following can be used as a trigger condition in a FortiSIEM notification policy?

   • AEvent severity
   • BStorage capacity
   • CUser login time
   • DNetwork bandwidth
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A government agency's FortiSIEM administrator is configuring a notification policy for a new threat-detection rule. The policy must send an email to the security operations center (SOC) and also log the notification to the local syslog server for archival. The administrator has created the policy and configured the trigger. What is the most efficient way to configure the actions?

   • AAdd only an email action and configure the SOC to archive the emails manually.
   • BAdd an email action and a syslog action to the same notification policy.
   • CAdd only a syslog action and configure the SOC to monitor the syslog server.
   • DCreate two separate notification policies with the same trigger, one for email and one for syslog.
   Reveal Solution Discussion Select an answer first