Free NSE5_FSM-6.3: Fortinet NSE 5 - FortiSIEM 6.3 Exam Questions and Answers

A FortiSIEM rule must trigger when a single source IP generates 10 or more failed VPN logons within 5 minutes, and it must create a separate incident for each source IP. The sub-pattern filter already matches the failed VPN logon event type. Which configuration completes the sub-pattern?

• AA. Aggregate: COUNT(DISTINCT Source IP) >= 10; Group By: Source IP
• BB. Aggregate: COUNT(Matched Events) >= 10; Group By: Source IP
• CC. Aggregate: COUNT(Matched Events) >= 10; Group By: Reporting Device
• DD. Aggregate: COUNT(Matched Events) >= 10; Group By: Event Type

A SOC manager needs a saved report to run every Monday at 06:00 and be delivered to the SOC mailbox. Which FortiSIEM reporting function should be used?

• AA. Create a rule from the report filter with an email notification action
• BB. Attach the report to a notification policy that emails the SOC mailbox
• CC. Schedule the report with a weekly recurrence and an email recipient
• DD. Pin the report to a dashboard and share the dashboard with the SOC

An administrator runs discovery from a Collector against a new Cisco switch. The switch answers ICMP, but it appears in the CMDB as a generic device with ping-only availability. The discovery log shows an SNMP timeout. The same SNMP community string, tested with an SNMP walk from the administrator's workstation, returns data. What is the most likely cause?

• AA. The Collector does not have a WMI credential for the switch's IP address
• BB. The Supervisor has not yet synchronized the new device with the CMDB
• CC. The SNMP access list on the switch does not permit the Collector's IP address
• DD. The switch is not configured to forward syslog to the Collector's IP address

A rule uses the filter Event Type = Win-Security-4625 to detect failed logons. The administrator must extend the rule to cover failed logons from Linux SSH and FortiGate administrator sessions. The change must not require a list of vendor-specific event types and must not match unrelated events. What should the administrator do?

• AA. Replace the filter with a failed logon event type group
• BB. Replace the filter with Event Severity >= 5
• CC. Replace the filter with Reporting Vendor IN Microsoft, Linux, Fortinet
• DD. Replace the filter with Raw Event Log CONTAINS "failed"

What is the primary role of a FortiSIEM Collector?

• AA. Collects data from monitored devices and forwards it to Workers
• BB. Stores events in the event database and serves the GUI to users
• CC. Correlates events against rules and generates incidents in real time
• DD. Holds the CMDB and the results of device discovery in a database

Which two actions can move an incident to the Cleared status in FortiSIEM? (Choose two.)

Select 2 answers.

• AA. The rule's clear condition is satisfied
• BB. The notification policy delivers the email to its recipient
• CC. A user with permission manually clears the incident
• DD. The incident is assigned to an analyst

An analyst must build a report listing the 10 source IP addresses that sent the most data over the last 24 hours. Which report configuration meets this requirement?

• AA. Group By: Source IP; Display: SUM(Sent Bytes); Order By: SUM(Sent Bytes) DESC; Limit: 10
• BB. Group By: Destination IP; Display: SUM(Sent Bytes); Order By: SUM(Sent Bytes) DESC; Limit: 10
• CC. Group By: Source IP; Display: COUNT(Matched Events); Order By: COUNT(Matched Events) DESC; Limit: 10
• DD. Group By: Source IP; Display: SUM(Sent Bytes); Order By: SUM(Sent Bytes) ASC; Limit: 10

A FortiSIEM cluster has one Supervisor and three Workers. Which two functions are performed by the Supervisor but not by the Workers? (Choose two.)

Select 2 answers.

• AA. Hosting the CMDB database
• BB. Serving the web GUI to users
• CC. Parsing incoming events into structured data
• DD. Running queries against the event database

An administrator must discover all hosts in 10.40.0.0/24 except 10.40.0.1 through 10.40.0.20, which are managed by another team. What should the administrator configure in the discovery definition?

• AA. A Smart Scan seeded with 10.40.0.21, with no further scope settings
• BB. A Range Scan with the include range 10.40.0.0/24 and the exclude range 10.40.0.1-10.40.0.20
• CC. A Single Device discovery for each address from 10.40.0.21 to 10.40.0.254
• DD. An L2 Scan that starts from the core switch and follows its ARP table entries

A FortiSIEM administrator added a Worker to the cluster, but no events appear to be parsed by that node. Which command, run from the CLI of the Worker, shows whether the FortiSIEM back-end processes such as phParser and phMonitor are running?

• AA. netstat -an | grep 514
• BB. tail -f /opt/phoenix/log/phoenix.log
• CC. phstatus
• DD. service phagent status