Manage and Tune Incidents NSE6-FORTISIEM-ANALYST Practice Questions (Page 7)

Questions 31–33

1. 31foundation · easy

   In FortiSIEM, what does assigning an incident to a user or group accomplish?

   • AIt automatically resolves the incident
   • BIt establishes ownership for triage and investigation
   • CIt deletes the incident from the system
   • DIt changes the incident's priority to critical
   Reveal Solution Discussion Select an answer first
2. 32foundation · easy

   When creating a tuning rule in FortiSIEM, what must you specify to determine which incidents are affected?

   • AThe conditions that match the incidents to be tuned
   • BThe physical server hosting the FortiSIEM collector
   • CThe email address of the incident assignee
   • DThe storage location of the incident logs
   Reveal Solution Discussion Select an answer first
3. 33expert · hard

   A FortiSIEM administrator is configuring incident assignment for a 24/7 security operations center. The team has three shifts, and the administrator wants to ensure that incidents are assigned to the analyst on duty at the time the incident is created. What should the administrator do?

   • AAssign all incidents to a single group and let the analysts manually claim them.
   • BSet the incident priority to 'Critical' so that all analysts are notified.
   • CManually assign incidents to the on-duty analyst each time.
   • DCreate assignment rules that use a schedule to assign incidents to the appropriate shift group.
   Reveal Solution Discussion Select an answer first