Manage and Tune Incidents NSE6-FORTISIEM-ANALYST Practice Questions (Page 6)

Questions 26–30

1. 26expert · hard

   A FortiSIEM administrator is receiving a high volume of incidents from a correlation rule that detects a specific attack pattern. The rule is generating both true positives and false positives. The administrator wants to reduce false positives without missing any true positives. What should the administrator do?

   • ACreate a tuning rule that suppresses incidents when the source IP is in a known benign list.
   • BRefine the correlation rule by adding additional conditions that are present in true positives but absent in false positives.
   • CDisable the correlation rule and rely on manual monitoring.
   • DIncrease the aggregation window to group more events into a single incident.
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   In FortiSIEM, which stage of the incident lifecycle represents the point at which an incident has been fully investigated and no further action is required?

   • AIn Progress
   • BAssigned
   • COpen
   • DResolved
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   What is a whitelist used for in FortiSIEM incident management?

   • ATo delete incidents from the database
   • BTo allow specific entities to be excluded from incident generation
   • CTo increase the severity of incidents from specific sources
   • DTo assign incidents to a specific group
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   How does incident grouping in FortiSIEM help analysts manage their workload?

   • ABy increasing the priority of all incidents
   • BBy combining related incidents into a single view
   • CBy preventing any new incidents from being created
   • DBy deleting all incidents automatically
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A FortiSIEM administrator wants to ensure that incidents related to a specific critical server are always assigned to a particular analyst, regardless of the incident type. What should the administrator configure?

   • ACreate a tuning rule that suppresses incidents from that server.
   • BSet the incident priority to 'Critical' so the analyst knows to look for it.
   • CCreate an assignment rule that matches the server's hostname and assigns incidents to the analyst.
   • DManually assign each incident from that server as it appears.
   Reveal Solution Discussion Select an answer first