Identify Various Rule Components NSE6-FORTISIEM-ANALYST Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   A FortiSIEM rule includes a component that specifies what should happen when the rule's conditions are satisfied. What is this component called?

   • ANotification
   • BFilter
   • CAction
   • DCondition
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   Which of the following is a configurable attribute of a 'condition' component in a FortiSIEM rule?

   • AThe maximum number of events per second
   • BThe event attribute to compare, such as 'destination IP'
   • CThe time window for the rule to be active
   • DThe email address for notifications
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   What is the function of the 'condition' component in a FortiSIEM rule?

   • AIt controls the priority of the rule
   • BIt limits the events that enter the rule engine
   • CIt determines the output format of the incident
   • DIt defines the criteria that events must meet for the rule to trigger
   Reveal Solution Discussion Select an answer first
5. 4expert · hard

   A FortiSIEM rule is designed to detect port scanning by counting connections to multiple ports from the same source IP within a short time. The rule uses a filter for network traffic, a condition that groups by source IP and counts distinct destination ports, and an action that sends an alert. The rule is not firing even though a scan is occurring. The analyst has verified that the filter is correct and the events are being collected. Which component is most likely misconfigured?

   • AThe filter is excluding the network traffic
   • BThe rule is missing a notification action
   • CThe condition is not correctly counting distinct destination ports
   • DThe action is configured to send an alert only once per day
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A FortiSIEM rule is designed to detect multiple failed login attempts followed by a successful login. The rule uses a filter to select authentication events, a condition to count failures, and an action to create a ticket. However, the rule fires even when the successful login occurs before the failed attempts. Which component's configuration is most likely causing this behavior?

   • AThe action is configured to create a ticket immediately
   • BThe condition lacks a time window or sequence constraint
   • CThe filter is not correctly set to authentication events
   • DThe rule is missing a notification action
   Reveal Solution Discussion Select an answer first