Integrate User and Entity Behavior Analytics (UEBA) Data into Rules and Dashboards NSE6-FORTISIEM-ANALYST Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A SOC manager wants to create a dashboard that shows the top 5 users with the highest UEBA risk scores, along with a summary of the types of anomalies they have triggered. Which combination of widgets is most appropriate?

   • AA single pie chart showing the distribution of risk scores.
   • BA line chart showing risk score trends and a gauge showing the average risk score.
   • CA single table widget that lists all users and their risk scores.
   • DA table widget listing the top users and a pie chart showing the anomaly types.
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A company has multiple data sources (VPN, firewall, and endpoint) feeding FortiSIEM. They want to build a UEBA baseline for user behavior. Which approach is most effective?

   • AUse only the VPN logs to build the baseline, as they represent user access.
   • BConfigure all relevant data sources to forward events to FortiSIEM and let the UEBA engine correlate them for each user.
   • CUse only the firewall logs, as they capture all network traffic.
   • DCreate separate baselines for each data source and combine them manually.
   Reveal Solution Discussion Select an answer first
4. 13foundation · medium

   When configuring a UEBA data source in FortiSIEM, which type of data is typically required to build accurate user behavior baselines?

   • AAuthentication and access logs
   • BNetwork flow records only
   • CVulnerability scan results
   • DConfiguration backup files
   Reveal Solution Discussion Select an answer first
5. 14foundation · medium

   Which FortiSIEM rule element allows you to incorporate UEBA anomaly scores into a detection rule?

   • AFilter
   • BNotification
   • CAggregation
   • DUEBA condition
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   A company is concerned about data privacy and wants to use UEBA without storing raw user content. What is the best approach?

   • AUse a separate UEBA system that does not integrate with FortiSIEM.
   • BStore raw content but restrict access to it.
   • CDisable UEBA entirely to avoid any data storage.
   • DConfigure data sources to forward only metadata and event attributes, not raw content.
   Reveal Solution Discussion Select an answer first