A company has a mix of on-premises and cloud-based applications. They want to use UEBA to monitor user behavior across both environments. What is the best approach?

Use only on-premises logs, as they are more secure.

Configure data sources for both on-premises and cloud applications to forward logs to FortiSIEM.

Create separate UEBA profiles for on-premises and cloud users.

Use only cloud logs, as they are more accessible.

A SOC analyst wants to add a widget to a dashboard that shows the distribution of UEBA risk scores across all users. Which widget type is most appropriate?

A pie chart that shows the percentage of users in each risk score range.

A line chart that shows the risk score of each user over time.

A gauge that shows the average risk score.

A table that lists each user's risk score.

An analyst wants to create a rule that triggers when a user's UEBA risk score increases significantly from their baseline. Which UEBA attribute should the rule reference?

The user's current risk score and their baseline risk score.

An analyst wants to create a rule that triggers when a user performs an activity that is not typical for them, such as accessing a system they have never accessed before. Which UEBA attribute should the rule reference?

The user's baseline of accessed systems.

FortinetNSE 6 - FortiSIEM Analyst

Domain 5Objective 2

Integrate User and Entity Behavior Analytics (UEBA) Data into Rules and Dashboards NSE6-FORTISIEM-ANALYST Practice Questions (Page 2)

Part of the ML, UEBA, and ZTNA domain, which makes up ~28% of our current practice bank. Fortinet does not publish an official question count, but from its 70-minute exam (~30–45 total, ~8–13 in this domain), expect 3–4 from this objective — we provide 22 practice questions to prepare you well beyond it. (estimate)

22questions here

5free pages

4concepts

Questions 6–10

6foundation · medium
Which dashboard widget type is most appropriate for displaying UEBA anomaly scores over time?
Select an answer first
7expert · hard
A company has a mix of on-premises and cloud-based applications. They want to use UEBA to monitor user behavior across both environments. What is the best approach?
Select an answer first
8application · medium
A SOC analyst wants to add a widget to a dashboard that shows the distribution of UEBA risk scores across all users. Which widget type is most appropriate?
Select an answer first
9application · medium
An analyst wants to create a rule that triggers when a user's UEBA risk score increases significantly from their baseline. Which UEBA attribute should the rule reference?
Select an answer first
10application · medium
An analyst wants to create a rule that triggers when a user performs an activity that is not typical for them, such as accessing a system they have never accessed before. Which UEBA attribute should the rule reference?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to NSE6-FORTISIEM-ANALYST

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Fortinet. “NSE6-FORTISIEM-ANALYST” is a trademark of its owner, used for identification only.