Perform Configuration Management Database (CMDB) and Lookup Table Queries NSE6-FORTISIEM-ANALYST Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   In a FortiSIEM lookup table query, how do you filter rows based on a specific key-value condition?

   • AUse the SELECT clause to specify the column
   • BUse the GROUP BY clause to group by the value
   • CUse the WHERE clause with a condition like column = value
   • DUse the ORDER BY clause to sort by the value
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   An analyst needs to produce a report showing each device's hostname, its assigned business unit, and the name of the responsible administrator. The CMDB stores device information in one table and business unit/administrator details in another table. What is the most efficient way to generate this report?

   • ARun a CMDB query that joins the device table with the business unit table on a common key and selects the hostname, business unit, and administrator fields.
   • BQuery the business unit table for all records and then use the device table to filter out devices without an administrator.
   • CQuery the device table for hostnames and the business unit table for administrators, then use a lookup table to map them together.
   • DRun two separate queries—one for device details and one for business unit details—then manually combine the results in a spreadsheet.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   In FortiSIEM, when joining a lookup table with an event table, what is typically used as the join condition?

   • AThe device vendor
   • BA common field such as an IP address or username
   • CThe event severity level
   • DThe event timestamp
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   What is the primary purpose of executing a basic CMDB query in FortiSIEM?

   • ATo retrieve device and asset information stored in the configuration management database
   • BTo analyze real-time security events and alerts
   • CTo configure SIEM collection and parsing rules
   • DTo generate compliance reports for regulatory audits
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   An analyst wants to enrich event data with information from a custom lookup table that maps source IP addresses to asset owners. The event data is stored in a standard FortiSIEM table. What is the correct approach to combine these data sources?

   • ACreate a new lookup table that contains both event data and asset owner information.
   • BQuery the lookup table for all asset owners and then use a separate event query to correlate them.
   • CJoin the event table with the lookup table on the source IP address field.
   • DRun a CMDB query to retrieve asset owners and then manually add them to the event data.
   Reveal Solution Discussion Select an answer first