Manage and Tune Incidents NSE6-FORTISIEM-ANALYST Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A FortiSIEM administrator is seeing a large number of incidents that are duplicates of the same event, but they are being generated by different correlation rules. The administrator wants to consolidate these duplicates into a single incident to reduce alert fatigue. What should the administrator do?

   • AManually merge the incidents in the console each time they appear.
   • BCreate a tuning rule that suppresses incidents from all but one rule.
   • CConfigure incident grouping to consolidate incidents that share common attributes, such as source IP and event type.
   • DDisable all correlation rules except one that detects the event.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A FortiSIEM administrator wants to ensure that high-priority incidents are automatically assigned to the senior analyst on the team, while medium-priority incidents are assigned to a group of junior analysts. The administrator wants to minimize manual intervention. What should the administrator configure?

   • AManually assign each incident as it appears in the console.
   • BUse a whitelist to suppress medium-priority incidents so only high-priority ones appear.
   • CSet the incident priority in the correlation rule and configure assignment rules based on priority.
   • DCreate a tuning rule that changes the priority of incidents to 'High' for all incidents.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   How can historical incident data be used to improve FortiSIEM tuning?

   • ABy analyzing patterns to adjust tuning rules and reduce false positives
   • BBy increasing the polling interval for devices
   • CBy changing the time zone of the server
   • DBy deleting old incidents to free up storage
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   Which incident status in FortiSIEM indicates that an incident has been fully investigated and closed?

   • AResolved
   • BAssigned
   • CIn Progress
   • DOpen
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   What is the purpose of the incident review feature in FortiSIEM?

   • ATo provide feedback on the accuracy of incidents
   • BTo assign incidents to users
   • CTo automatically delete all incidents
   • DTo increase the priority of incidents
   Reveal Solution Discussion Select an answer first