Perform Nested Query Lookups NSE6-FORTISIEM-ANALYST Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   Which FortiSIEM query construct best describes the following scenario: an analyst wants to find all login events from users who have been flagged in a separate 'suspicious users' lookup table?

   • AA scheduled search that first exports the suspicious user list to a CSV file and then imports that file into a second query
   • BA report that runs two separate queries and displays their results side by side in the same dashboard
   • CA nested query where the inner query retrieves the suspicious user list and the outer query filters login events by that list
   • DA single flat query that joins the login events table directly with the suspicious users table using a JOIN clause
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   An analyst needs to find all user accounts that have been locked out more than twice in the last hour. The analyst has a query that returns account lockout events with the user name. Which nested query approach should be used?

   • AInner query: all account lockout events. Outer query: filter by user count > 2.
   • BSingle query: account lockout events where user count > 2.
   • CInner query: account lockout events grouped by user with count > 2. Outer query: list of users from the inner query result.
   • DInner query: users with any lockout. Outer query: account lockout events where user is in the inner query result.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   An analyst wants to identify all servers that have communicated with a known malicious IP address in the last hour. The analyst has a query for network traffic events and a query that returns the malicious IP address. Which nested query approach is correct?

   • AInner query: the query that returns the malicious IP. Outer query: network traffic events where destination IP equals the inner query result.
   • BInner query: network traffic events. Outer query: the malicious IP query, filtered by traffic events.
   • CInner query: network traffic events. Outer query: network traffic events where destination IP is in the inner query result.
   • DSingle query: network traffic events where destination IP is malicious.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   An analyst needs to find all VPN login events from users who have not logged in during the past 30 days. The analyst has a query for VPN login events and a query for all login events. Which nested query approach should be used?

   • AInner query: VPN login events. Outer query: VPN login events where user is NOT in the inner query result.
   • BSingle query: VPN login events where the user has no login in the last 30 days.
   • CInner query: VPN login events. Outer query: all login events in the last 30 days where user is NOT in the inner query result.
   • DInner query: all login events in the last 30 days to get a list of active users. Outer query: VPN login events where user is NOT in the inner query result.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A SOC analyst needs to list all users who have accessed a specific sensitive file share in the last week, but only if those users have also had a security alert in the last 24 hours. The analyst has queries for file access events and security alerts. Which nested query approach is correct?

   • AInner query: all users. Outer query: file access events for the sensitive share.
   • BInner query: file access events for the sensitive share. Outer query: security alerts where user is in the inner query result.
   • CInner query: users with security alerts in last 24 hours. Outer query: file access events for the sensitive share where user is in the inner query result.
   • DSingle query: file access events for the sensitive share, filtered by whether the user has any alert.
   Reveal Solution Discussion Select an answer first