Manage and Tune Incidents NSE6-FORTISIEM-ANALYST Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A FortiSIEM administrator wants to use historical incident data to identify patterns of false positives and adjust tuning rules accordingly. What should the administrator do?

   • AIncrease the priority of all incidents to ensure they are reviewed.
   • BDisable all correlation rules that have generated false positives in the past.
   • CReview incident feedback and use it to create or modify tuning rules.
   • DDelete historical incidents that were false positives.
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   What is the primary purpose of managing incidents through their lifecycle stages in FortiSIEM?

   • ATo delete incidents automatically after a set period
   • BTo increase the volume of incidents generated by the system
   • CTo prevent all incidents from being created
   • DTo track the progress of an incident from detection to closure
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   What is the primary benefit of incident deduplication in FortiSIEM?

   • AIt increases the storage capacity of the system
   • BIt automatically resolves all incidents
   • CIt speeds up event collection from devices
   • DIt reduces alert fatigue by consolidating duplicate incidents
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A FortiSIEM administrator wants to improve the accuracy of incident detection by using feedback from analysts on whether incidents were true positives or false positives. The administrator wants to use this feedback to automatically adjust tuning rules. What should the administrator do?

   • AUse the incident review feature to mark incidents as false positives and apply the feedback to tuning rules.
   • BIncrease the priority of all incidents to ensure they are reviewed.
   • CDisable all correlation rules that generate false positives.
   • DManually create a tuning rule for each false positive incident.
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   How does FortiSIEM reduce the number of incidents generated from many related events?

   • ABy aggregating related events into a single incident
   • BBy assigning a higher priority to each event
   • CBy deleting events that are not critical
   • DBy increasing the polling interval for all devices
   Reveal Solution Discussion Select an answer first