When modifying a rule to use UEBA data, what must you ensure about the rule's event filter?

It excludes all authentication events

It includes the UEBA event type

In FortiSIEM, what is the first step to configure a UEBA data source?

Select the data source type and configure its collection parameters

Create a dashboard to visualize the data

Enable the UEBA engine in the system settings

A SOC manager wants to display a dashboard that shows the top users with the highest risk scores based on UEBA data. What is the most appropriate widget to use in a FortiSIEM dashboard for this purpose?

A gauge widget that displays the average risk score of all users.

A pie chart that shows the distribution of risk scores across all users.

A table widget that lists users sorted by their UEBA risk score.

A line chart that plots risk score over time for a single user.

An organization wants to feed Active Directory authentication logs into FortiSIEM to enable UEBA for user behavior. Which step is essential to ensure the UEBA engine can use this data?

Enable the UEBA license in FortiSIEM.

Manually upload authentication logs to FortiSIEM daily.

Configure the Active Directory collector to forward authentication events to FortiSIEM.

Create a rule that triggers on authentication events.

A manager wants a dashboard that shows the top 10 users with the highest UEBA risk scores and also allows drill-down to see the contributing events. Which dashboard feature should be used?

A gauge showing the overall risk score.

A pie chart showing the proportion of risk scores.

A line chart showing the average risk score over time.

A table widget with a drill-down action that links to a detailed event view.

FortinetNSE 6 - FortiSIEM Analyst

Domain 5Objective 2

Integrate User and Entity Behavior Analytics (UEBA) Data into Rules and Dashboards NSE6-FORTISIEM-ANALYST Practice Questions (Page 4)

Part of the ML, UEBA, and ZTNA domain, which makes up ~28% of our current practice bank. Fortinet does not publish an official question count, but from its 70-minute exam (~30–45 total, ~8–13 in this domain), expect 3–4 from this objective — we provide 22 practice questions to prepare you well beyond it. (estimate)

22questions here

5free pages

4concepts

Questions 16–20

16foundation · medium
When modifying a rule to use UEBA data, what must you ensure about the rule's event filter?
Select an answer first
17foundation · medium
In FortiSIEM, what is the first step to configure a UEBA data source?
Select an answer first
18application · medium
A SOC manager wants to display a dashboard that shows the top users with the highest risk scores based on UEBA data. What is the most appropriate widget to use in a FortiSIEM dashboard for this purpose?
Select an answer first
19application · medium
An organization wants to feed Active Directory authentication logs into FortiSIEM to enable UEBA for user behavior. Which step is essential to ensure the UEBA engine can use this data?
Select an answer first
20application · medium
A manager wants a dashboard that shows the top 10 users with the highest UEBA risk scores and also allows drill-down to see the contributing events. Which dashboard feature should be used?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to NSE6-FORTISIEM-ANALYST

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Fortinet. “NSE6-FORTISIEM-ANALYST” is a trademark of its owner, used for identification only.