Fortinet NSE6_FSM_AN-7.4 Dumps

The correct answers are A. Process and C. Resources. FortiSIEM UEBA/EBA analytics uses endpoint and behavior-related telemetry to identify abnormal activity. The Study Guide explains that the UEBA incident dashboard shows incidents that the AI module creates based on alerts received from FortiInsight. The UEBA attribute list includes the incident name, host, application, user, tag, and activity. This aligns with process-oriented activity monitoring from endpoint agents. The performance and baseline lessons also explain that FortiSIEM collects performance and availability data from devices and applications, including resource-utilization metrics, and uses that information to build baselines and detect anomalous activity. Resource behavior includes CPU, memory, disk, I/O, and similar utilization patterns, which are valid behavioral-model inputs. Location and Network are important FortiSIEM context areas, but in this question’s EBA machine learning model choices, the valid model areas are process behavior and resource behavior. Process reflects what is running or being executed; Resources reflects system or application utilization behavior. Together, these are the two data areas used for EBA machine learning models.

The correct answer is B because the configuration groups results by Source IP and Destination IP , while using COUNT(Matched Events) as a display/aggregate value. FortiSIEM’s grouping logic combines events only when the selected Group By attributes match. The Study Guide explains that Group By attributes determine how matching events are placed into rows, and that when multiple events share the same grouped values, “they are grouped together in one row.” The count column then tracks the number of events represented by that row. In the exhibit, Source IP and Destination IP are the grouping fields, so FortiSIEM displays each unique connection pair once. The count shows how many matching allowed firewall connection events were seen for each pair. Option A is not correct because the exhibit does not show sorting by destination IP hit count. Option C ignores the source and destination grouping. Option D would require grouping by source IP alone or by distinct destination counts per source, which is not the shown configuration.

The Incident Status shows " Auto Cleared " , and the Cleared Reason states: " Rule has not been triggered for 20 minutes. " This indicates that the incident was automatically cleared by the rule logic after a defined period of inactivity.

The correct answer is C because the exhibit shows the incident status as Auto Cleared and the cleared reason indicates that the rule condition was no longer being triggered. The Study Guide explains that FortiSIEM supports clear conditions and auto-clearing behavior at the rule level. It states that if a time-based clear condition is configured, FortiSIEM can auto-clear the incident after the last occurrence if the trigger condition no longer exists. It also explains pattern-based clear behavior: FortiSIEM evaluates clear-condition subpatterns and compares attributes from the clear condition with the original incident attributes. If the configured attributes match, the incident status is set to auto cleared. In the exhibit, the cleared reason says the rule has not been triggered for a defined number of minutes. That is not a manual action by the analyst and not an endpoint-generated all-clear signal. It is FortiSIEM’s rule-based clearing logic. Option B is also wrong because the exhibit shows a specific rule inactivity period, not a generic 24-hour timeout.

The exhibit shows a machine learning Regression configuration. In FortiSIEM regression, selected numerical fields are used as predictors, and another field is selected as the value to predict. The FortiSIEM 7.4 User Guide’s Machine Learning section lists Regression separately and describes the training workflow, including selecting fields used by the algorithm. The exhibit shows Memory Utilization, Sent Bytes, and Received Bytes selected under Fields to use for Prediction, while CPU Utilization is selected under Field to Predict. This means Memory Utilization is an input variable used by the model. If memory utilization is consistently high during training or retraining, that higher value becomes part of the learned model pattern. FortiSIEM does not automatically trigger a high-memory incident merely because a regression input value is high; an incident would require inference behavior and an anomaly action or rule configuration. Option C is also wrong because FortiSIEM does not dynamically lower a CPU trigger threshold just because memory is high. The correct behavior is model update based on the higher observed input value.

The correct answer is B because the analyst is searching for events to either of two destination IP addresses, but the filter uses the wrong Boolean relationship. The FortiSIEM Study Guide explains structured searches with multiple conditions and states that “when you use multiple conditions, you must specify the next logical operator between conditions.” It gives a direct example: when searching for events from two specific devices, the first condition is one IP address, the second condition is another IP address, and “the next logical operator between the two conditions is an OR operator, because the search is for events from condition 1 OR condition 2.” The same logic applies here. A single event cannot usually have Destination IP equal to 10.10.1.1 and Destination IP equal to 192.168.1.1 at the same time. Using AND requires both conditions to be true simultaneously, so no results are returned. The correct operator between the two Destination IP conditions is OR.

The correct answer is D because Server A satisfies the rule’s threshold and count requirements, while Server B does not. The Study Guide explains that a FortiSIEM subpattern consists of Filter , Aggregate , and Group By components. It also states that the Aggregate function defines how many or what metric values must match during the time window, while Group By controls how the matching events are grouped into rows. The performance metrics lesson explains that FortiSIEM collects performance and availability data, converts polling results into logs, and uses those metrics for performance, availability, resource utilization, and baselining. In the exhibit, the aggregate evaluates CPU utilization against the device’s CPU critical threshold and also requires a matched-event count of at least two within the 10-minute window. Server A has CPU values above its critical threshold enough times in the window, so it generates one incident. Server B has a lower configured threshold but its collected CPU values do not satisfy the required aggregate condition for the grouped server. Therefore, only Server A generates an incident.

The correct answer is C. CMDB user group . In FortiSIEM, users and user groups are maintained as CMDB objects and can be referenced in analytics filters and rule logic. The FortiSIEM 7.4 User Guide table of contents explicitly includes CMDB management for users, viewing user information, adding users, editing or deleting users, performing operations on users, and working with user groups. This confirms that user groups are part of the FortiSIEM CMDB data model. The query shown in the exhibit uses the Analytics filter with the User attribute and the value Group: FortiSIEM Analysts . That syntax indicates that FortiSIEM is referencing a FortiSIEM-defined user group from CMDB, not an LDAP group directly and not an Active Directory group directly. LDAP and Active Directory can be used to discover or authenticate users, but once referenced as a FortiSIEM analytics group value, the object is a CMDB user group. FortiSIEM organization groups are tenant/organization constructs and are not the same as CMDB user groups.

The correct answer is A. Design. In the FortiSIEM 7.4 User Guide’s anomaly detection workflow, the first configuration step is Step 1: Design. In that step, FortiSIEM requires the analyst to identify the fields that will be analyzed by the machine learning job. The guide states that under Design, the analyst must identify Fields to Analyze, and explains that these fields are considered for anomaly detection and must currently be numerical fields. The guide also identifies the time field requirement for statistical deviation algorithms and notes that a FortiSIEM report is used to provide the dataset. The Prepare Data step comes later and is used to load or prepare the data source for training. The Train step runs the algorithm against the prepared dataset. The Schedule step is used after training to run inference. Therefore, the selection of fields to analyze belongs to the Design phase, not Prepare Data, Train, or Schedule. This sequence matters because FortiSIEM must know which numerical fields are relevant before it can prepare, train, or run inference on the machine learning job.

Grouping by User, Source IP, and Count means that each unique combination of those three attributes will be treated as a separate result. In the table, all six rows have distinct combinations of User, Source IP, and Count - so FortiSIEM will display 6 results.

Six because grouping by User , Source IP , and Count creates a separate result for every unique combination of those three selected attributes. The FortiSIEM Study Guide explains this grouping behavior in the single-subpattern rule example: “If multiple VPN login failure events have the same source IP address, reporting device, reporting IP address, and user, they are grouped together in one row, and the count column tracks the number of events for each of those rows.” Applying that rule here, FortiSIEM compares all selected Group By fields together. In the exhibit, every row has a unique Source IP address, even where the same user appears more than once. For example, Mike appears twice, but the Source IP and Count values are different. Alice appears twice with Count 2, but the Source IP values are different. Bob appears twice, but both Source IP and Count are different. Since no row has the same User, Source IP, and Count combination as another row, FortiSIEM displays all six rows.

The correct answer is Local Auto. The uploaded answer was right, but its explanation was sloppy because it incorrectly described Local mode as the most time-consuming mode. In FortiSIEM machine learning, Local Auto mode selects the best algorithm by evaluating multiple candidate algorithms. The User Guide states that in Local Auto mode, “FortiSIEM picks the best algorithm” and that the Max Run Time parameter limits how long the job can run; longer runtime can produce better results. That is why Local Auto can take the most time. Forecasting and Regression are task types, not run modes.

The fields are highlighted in red because unique values such as Event Receive Time and Raw Event Log cannot be used in group-by operations. Grouping requires aggregatable or consistent values across events, while these fields are unique to each event, making them incompatible for grouping.

The correct answer is A because the highlighted fields are not valid for that grouped/aggregated display configuration. The FortiSIEM 7.4 User Guide notes that some event attributes, functions, and queries are not supported in specific analytics result-filter and display contexts. It lists date fields, including examples such as Event Receive Time , and also lists Raw Event Log and Binary Raw Event Log among unsupported fields for that context. The reason is practical: grouping requires stable values that can combine multiple events into meaningful grouped rows. Attributes such as Event Receive Time and Raw Event Log are highly specific to individual events. If every event has its own receive timestamp or unique raw log content, grouping by those fields defeats aggregation and can create one row per event rather than meaningful grouped output. COUNT(Matched Events) itself is a valid aggregate expression when used correctly. Event Receive Time is available in logs, but it is not appropriate as a grouped field in the configuration shown. Therefore, the red highlighting indicates invalid grouped fields caused by unique/non-groupable values.

The correct answer is B. FortiSIEM does not create a separate incident every time the same rule condition repeats. The FortiSIEM Study Guide explains that rules process events based on time periods, and if the same rule with the same incident conditions triggers repeatedly, FortiSIEM increases the count instead of creating a new incident. The incident list view includes the incident Count field for this purpose. The guide further explains that when an incident triggers for the first time, FortiSIEM sets First Occurred and Last Occurred to the same value. When the incident triggers again within the rule evaluation period, FortiSIEM increases the count and updates Last Occurred, while the triggered Events view displays the latest event data. This behavior prevents duplicate incident flooding while preserving evidence that the condition is recurring. Option A is incorrect because FortiSIEM does not use a “Repeated” incident status. Option C and D are incorrect because FortiSIEM does not generate a new incident for every repeated trigger when the incident conditions match an already active incident.

FortiSIEM grouping works by combining events that have the same values for all selected Group By attributes. The Study Guide’s rule and subpattern example states that when multiple events have the same Group By values, “they are grouped together in one row, and the count column tracks the number of events for each of those rows.” In the exhibit, the selected grouping fields are Reporting Device, Reporting IP, and Application Category. The table contains six raw rows, but two rows share the same grouped combination: FW01 / 10.1.1.1 / DB . Those two rows are collapsed into one grouped result. The other combinations are unique: FW02 / 10.1.1.2 / WebApp, FW01 / 10.1.1.1 / SSH, FW03 / 10.1.1.3 / DB, and FW04 / 10.1.1.4 / SSH. That creates five grouped rows in total. FortiSIEM does not display six because grouping removes duplicate combinations, and it does not display four because only one duplicate combination exists.

The correct answer is B. Train. In FortiSIEM machine learning, the Train step is where the model is built from the prepared dataset and where model-fitting behavior can be adjusted. The FortiSIEM 7.4 User Guide explains that after preparing data, the analyst goes to Analytics > Machine Learning > Train, selects the machine learning task, chooses the algorithm, selects the prediction/target fields when required, and chooses the Train factor, which determines how much data is used for training versus testing. The guide states that the Train factor should be greater than 70%, meaning 70% of the data is used for training and 30% for testing. It also explains that model quality metrics show how accurately the algorithm predicts the field. For regression, lower MAE means a better fit, and R2 shows how well predictions approximate real data points. Most importantly, the guide states: “If you want to change the algorithm parameters and re-train, then click Tune & Train, change the parameters and click Save & Train.” This confirms that modifying how the model fits the training dataset is done in the Train step, not Prepare Data, Statistics, or Design.