Manage and Tune Incidents NSE6-FORTISIEM-ANALYST Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   Which action in FortiSIEM allows an analyst to indicate the severity of an incident for triage prioritization?

   • AChanging the incident's status to Resolved
   • BSetting the incident priority
   • CAdding a comment to the incident
   • DDeleting the incident
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A FortiSIEM administrator is seeing a high volume of incidents from a correlation rule that triggers on a specific combination of events. The administrator has determined that the rule is too sensitive and wants to reduce the number of incidents without completely disabling the rule. What should the administrator do?

   • AModify the correlation rule to require additional conditions before triggering.
   • BManually close the incidents as they appear.
   • CCreate a tuning rule that suppresses all incidents from that rule.
   • DIncrease the incident priority to make them more visible.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A FortiSIEM administrator notices that a specific legitimate vulnerability scanner is triggering a high-severity incident every time it runs, flooding the queue. The scanner's IP is static and the signature is well-known. The administrator wants to stop these incidents while preserving the ability to see the raw events if needed. What should the administrator do?

   • AManually close each incident as it appears and add a note that it is a false positive.
   • BAdd the scanner's IP to a global whitelist that blocks all events from that IP.
   • CCreate a tuning rule that suppresses incidents when the source IP matches the scanner and the event type matches the vulnerability scan signature.
   • DDisable the correlation rule that generates the incident.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   What is the purpose of a suppression rule in FortiSIEM?

   • ATo delete all historical incidents
   • BTo assign incidents to users
   • CTo prevent known false positives from generating incidents
   • DTo increase the priority of incidents
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A security analyst at a mid-sized company notices that a critical incident has been sitting in 'Open' status for over 24 hours because the originally assigned analyst is on leave. The incident requires immediate attention. The analyst wants to ensure the incident is actively worked and tracked to resolution. What should the analyst do first?

   • AReassign the incident to another analyst and update the status to 'Assigned'.
   • BChange the incident status to 'Resolved' and add a comment about the original analyst's leave.
   • CCreate a new incident with a higher priority and assign it to the available analyst.
   • DDelete the incident and recreate it after the analyst returns.
   Reveal Solution Discussion Select an answer first