Fortinet NSE5_FSM-6.3 Practice Questions

Which two FortiSIEM components work together to provide real-time event correlation?

A. Supervisor and worker

B. Collector and Windows agent

C. Worker and collector

D. Supervisor and collector

Refer to the exhibit.

How was the FortiGate device discovered by FortiSIEM?

A. GUI log discovery

B. Syslog discovery

C. Pull events discovery

D. Auto log discovery

Refer to the exhibit.

A FortiSIEM administrator wants to group some attributes for a report, but is not able to do so successfully.
As shown in the exhibit, why are some of the fields highlighted in red?

A. Unique attributes cannot be grouped.

B. The Event Receive Time attribute is not available for logs.

C. The attribute COUNT(Matched events) is an invalid expression.

D. No RAW Event Log attribute is available for devices.

In the rules engine, which condition instructs FortiSIEM to summarize and count the matching evaluated data?

A. Time Window

B. Aggregation

C. Group By

D. Filters

Refer to the exhibit.

Which value will FortiSIEM use to populate the Connection Id field?

A. 33909

B. 134

C. The connection ID is not in the raw message.

D. 408228

In which state can a device be moved into the CMDB to prevent monitoring log collection?

A. Unmanaged

B. Unapproved

C. Pending

D. Void

Which is a requirement for implementing FortiSIEM disaster recovery?

A. All worker nodes must access both supervisor nodes using IP.

B. SNMP, and WMI ports must be open between the two supervisor nodes.

C. The two supervisor nodes must have layer 2 connectivity.

D. DNS names must be used for the worker upload addresses.