Configure Remediation Options NSE6-FORTISIEM-ANALYST Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A FortiSIEM administrator has created a remediation action that sends an email to the security team when a high-priority incident is detected. However, the action is not being triggered. The administrator has verified that the email server settings are correct. What is the most likely cause of the issue?

   • AThe incident priority is not set to 'high'.
   • BThe email server is blocking the sender address.
   • CThe remediation rule is not associated with the action.
   • DThe notification policy is disabled.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A FortiSIEM administrator needs to ensure that when a critical incident is created, a ticket is automatically opened in the company's ITSM tool. The administrator has already configured the ITSM integration. What is the next step to achieve this?

   • AConfigure a notification policy to send an email to the ITSM system.
   • BEnable the 'auto-ticket' option in the incident settings.
   • CSet the incident priority to 'critical' so that it automatically creates a ticket.
   • DCreate a remediation action of type 'ticket' and associate it with a remediation rule.
   Reveal Solution Discussion Select an answer first
4. 3expert · medium

   A FortiSIEM administrator is configuring automated remediation for a phishing incident. The desired action is to block the sender's email address in the email gateway. However, the administrator is concerned about the action failing due to API rate limits. What is the best way to handle this?

   • AConfigure the remediation action to retry on failure.
   • BUse a script that handles rate limits instead of the API action.
   • CCreate a notification policy to alert the administrator when the action fails.
   • DSet the remediation action to run only once and ignore failures.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   In FortiSIEM, what is the primary purpose of configuring a remediation action?

   • ATo automatically quarantine a user or device when an incident is triggered
   • BTo define a set of automated steps that FortiSIEM executes in response to an incident
   • CTo manually document the steps an analyst took to resolve an incident
   • DTo generate a report summarizing all incidents in the last 24 hours
   Reveal Solution Discussion Select an answer first
6. 5expert · medium

   A FortiSIEM administrator is configuring a remediation action that runs a script on a remote server. The script requires elevated privileges. The administrator has created the action and associated it with a remediation rule. However, the action fails when triggered. What is the most likely cause?

   • AThe notification policy is not configured.
   • BThe script path is incorrect or the script is not accessible to the FortiSIEM service account.
   • CThe remediation rule is not associated with the action.
   • DThe incident is not high priority.
   Reveal Solution Discussion Select an answer first