An analyst needs to list all firewall deny events that occurred on the same source IP as a successful SSH login in the last 24 hours. The analyst has queries for firewall deny events and SSH login events. Which nested query approach is correct?

Inner query: firewall deny events. Outer query: firewall deny events where source IP is in the inner query result.

Inner query: firewall deny events. Outer query: SSH login events where source IP is in the inner query result.

Inner query: SSH login events to get a list of source IPs. Outer query: firewall deny events where source IP is in the inner query result.

Single query: firewall deny events where the source IP has a successful SSH login.

An analyst needs to find all user accounts that have been created in the last 30 days and have never successfully logged in. The analyst has queries for account creation events and successful login events. Which nested query approach should be used?

Inner query: successful login events to get a list of users who have logged in. Outer query: account creation events in the last 30 days where user is NOT in the inner query result.

Inner query: account creation events. Outer query: successful login events where user is NOT in the inner query result.

Inner query: account creation events. Outer query: account creation events where user is NOT in the inner query result.

Single query: account creation events where the user has no successful login.

A security analyst needs to identify all user accounts that have logged in from more than three different source IP addresses in the last 24 hours. The analyst has a working query that returns user accounts with their login source IPs. Which nested query approach should the analyst use?

Create an outer query that groups logins by user and source IP, then use a nested sub-query to count distinct source IPs per user and filter for counts greater than three.

Create a single flat query that filters logins by source IP count greater than three, without using a sub-query.

Use a nested query that filters the inner query by source IP count greater than three, then the outer query groups by user.

Use a nested query where the inner query returns all logins, and the outer query simply lists them without any aggregation or filter.

In FortiSIEM, what is the primary purpose of constructing a nested query?

To embed one query within another so that the outer query filters its results based on the outcome of the inner sub-query

To schedule a query to run at a later time after another query has completed

To combine multiple independent queries into a single report without any dependency between them

To replace the need for multiple separate queries by storing all results in a single temporary table

An analyst wants to find all firewall events where the destination IP was involved in a successful brute-force attack (more than 10 failed login attempts) in the past hour. The analyst has a query that returns failed login events with destination IPs. Which nested query structure should be used?

Inner query: failed login events grouped by destination IP with count > 10. Outer query: firewall events where destination IP is in the inner query result.

Single query: firewall events where destination IP has more than 10 failed logins, without a sub-query.

Inner query: all firewall events. Outer query: filter by destination IP count > 10.

Inner query: firewall events. Outer query: failed login events where destination IP is in the inner query.

FortinetNSE 6 - FortiSIEM Analyst

Domain 1Objective 4

Perform Nested Query Lookups NSE6-FORTISIEM-ANALYST Practice Questions (Page 2)

Part of the Analytics domain, which makes up ~18% of our current practice bank. Fortinet does not publish an official question count, but from its 70-minute exam (~30–45 total, ~5–8 in this domain), expect 1–2 from this objective — we provide 11 practice questions to prepare you well beyond it. (estimate)

11questions here

3free pages

1concept

Questions 6–10

6application · medium
An analyst needs to list all firewall deny events that occurred on the same source IP as a successful SSH login in the last 24 hours. The analyst has queries for firewall deny events and SSH login events. Which nested query approach is correct?
Select an answer first
7application · medium
An analyst needs to find all user accounts that have been created in the last 30 days and have never successfully logged in. The analyst has queries for account creation events and successful login events. Which nested query approach should be used?
Select an answer first
8application · medium
A security analyst needs to identify all user accounts that have logged in from more than three different source IP addresses in the last 24 hours. The analyst has a working query that returns user accounts with their login source IPs. Which nested query approach should the analyst use?
Select an answer first
9foundation · easy
In FortiSIEM, what is the primary purpose of constructing a nested query?
Select an answer first
10application · medium
An analyst wants to find all firewall events where the destination IP was involved in a successful brute-force attack (more than 10 failed login attempts) in the past hour. The analyst has a query that returns failed login events with destination IPs. Which nested query structure should be used?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to NSE6-FORTISIEM-ANALYST

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Fortinet. “NSE6-FORTISIEM-ANALYST” is a trademark of its owner, used for identification only.