Configure Remediation Options NSE6-FORTISIEM-ANALYST Practice Questions (Page 2)

Questions 6–9

1. 6application · medium

   A FortiSIEM administrator has created a remediation action that sends an email to the security team when a critical incident is detected. The action is not working. The administrator has verified that the email server settings are correct. What is the most likely cause?

   • AThe remediation action is not associated with a remediation rule.
   • BThe notification policy is disabled.
   • CThe incident priority is not set to 'critical'.
   • DThe email server is blocking the sender address.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A company's security policy requires that when a malware incident is confirmed, the affected endpoint is automatically quarantined. The FortiSIEM administrator has created a remediation action that calls the EDR platform's API to quarantine the endpoint. What must be configured to ensure this action is executed only for confirmed malware incidents, not for every malware-related event?

   • AUse a notification policy to manually approve the quarantine before it runs.
   • BConfigure the EDR integration to quarantine all endpoints with the malware signature.
   • CSet the remediation action to run on every event that matches the malware signature.
   • DCreate a remediation rule that filters incidents by the 'confirmed' status and the malware incident type.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   When configuring automated responses in FortiSIEM, where do you typically associate a remediation action so that it runs when an incident is created?

   • AIn the device's SNMP settings
   • BIn the user's account profile
   • CIn the notification policy for the rule that generates the incident
   • DIn the incident's comment section
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A security analyst at a mid-sized company wants to automatically block a source IP address in the firewall whenever FortiSIEM detects a brute-force attack. The analyst has already created a remediation action that calls the firewall's API. What must the analyst configure in FortiSIEM to ensure this action runs automatically when a specific incident pattern occurs?

   • ADefine a remediation rule that matches the incident and associates the remediation action with it.
   • BManually run the remediation action from the incident detail page each time.
   • CConfigure a report to include the remediation action as a scheduled task.
   • DCreate a notification policy that triggers the remediation action on incident creation.
   Reveal Solution Discussion Select an answer first