Pass the Fortinet NSE 6 Network Security Specialist NSE6_FSM_AN-7.4 Questions and answers with CertsForce

The correct answer is C because the rule’s Group By attributes determine how events are grouped before the aggregate condition is evaluated. The Study Guide explains that rule conditions are built from subpatterns consisting of event attribute filters and aggregation functions. It also explains that a subpattern combines filters, aggregate, and group by fields to form the rule logic. In this case, the filters may return matching events in Analytics, but the rule still may not trigger because the aggregate condition is calculated separately for each unique Group By combination. The exhibit groups by Destination IP and User while applying COUNT(Source IP) > = 2. This means FortiSIEM does not count all matching events together. Instead, it counts only events that share the same Destination IP and User combination. If no single grouped combination reaches the aggregate threshold, no incident is created. The issue is not the event lookup, not the Destination Host Name format, and not necessarily the aggregate expression itself. The grouping logic is what restricts the counted event set.

The correct answer is B. FortiSIEM does not create a separate incident every time the same rule condition repeats. The FortiSIEM Study Guide explains that rules process events based on time periods, and if the same rule with the same incident conditions triggers repeatedly, FortiSIEM increases the count instead of creating a new incident. The incident list view includes the incident Count field for this purpose. The guide further explains that when an incident triggers for the first time, FortiSIEM sets First Occurred and Last Occurred to the same value. When the incident triggers again within the rule evaluation period, FortiSIEM increases the count and updates Last Occurred, while the triggered Events view displays the latest event data. This behavior prevents duplicate incident flooding while preserving evidence that the condition is recurring. Option A is incorrect because FortiSIEM does not use a “Repeated” incident status. Option C and D are incorrect because FortiSIEM does not generate a new incident for every repeated trigger when the incident conditions match an already active incident.

Grouping by User, Source IP, and Count means that each unique combination of those three attributes will be treated as a separate result. In the table, all six rows have distinct combinations of User, Source IP, and Count - so FortiSIEM will display 6 results.

Six because grouping by User , Source IP , and Count creates a separate result for every unique combination of those three selected attributes. The FortiSIEM Study Guide explains this grouping behavior in the single-subpattern rule example: “If multiple VPN login failure events have the same source IP address, reporting device, reporting IP address, and user, they are grouped together in one row, and the count column tracks the number of events for each of those rows.” Applying that rule here, FortiSIEM compares all selected Group By fields together. In the exhibit, every row has a unique Source IP address, even where the same user appears more than once. For example, Mike appears twice, but the Source IP and Count values are different. Alice appears twice with Count 2, but the Source IP values are different. Bob appears twice, but both Source IP and Count are different. Since no row has the same User, Source IP, and Count combination as another row, FortiSIEM displays all six rows.

The correct answer is A. The FortiSIEM Study Guide explicitly lists Create Rule as one of the actions that can be performed directly from Analytics search results. The guide states that to perform actions on results, an analyst clicks Actions and can choose options such as Email Result, Export Result, Add Result to Case, Copy To New Tab, Save Report, and Create Rule. The rules lesson further explains what happens after clicking Create Rule: FortiSIEM opens a new rule configuration window and creates a subpattern based on the analytics search parameters. It states that FortiSIEM uses the analytics search filter conditions to create the rule subpattern filter conditions, uses the search display conditions to create the rule Group By conditions, and sets the Aggregate condition to COUNT(Matched Events) > = 1. Creating a new rule manually under Resources > Rules would work, but it is slower because the analyst must manually re-enter the search criteria. The direct Analytics > Actions > Create Rule workflow is the quickest method.

The Incident Status shows " Auto Cleared " , and the Cleared Reason states: " Rule has not been triggered for 20 minutes. " This indicates that the incident was automatically cleared by the rule logic after a defined period of inactivity.

The correct answer is C because the exhibit shows the incident status as Auto Cleared and the cleared reason indicates that the rule condition was no longer being triggered. The Study Guide explains that FortiSIEM supports clear conditions and auto-clearing behavior at the rule level. It states that if a time-based clear condition is configured, FortiSIEM can auto-clear the incident after the last occurrence if the trigger condition no longer exists. It also explains pattern-based clear behavior: FortiSIEM evaluates clear-condition subpatterns and compares attributes from the clear condition with the original incident attributes. If the configured attributes match, the incident status is set to auto cleared. In the exhibit, the cleared reason says the rule has not been triggered for a defined number of minutes. That is not a manual action by the analyst and not an endpoint-generated all-clear signal. It is FortiSIEM’s rule-based clearing logic. Option B is also wrong because the exhibit shows a specific rule inactivity period, not a generic 24-hour timeout.

The best answer is A. Two . The exhibit shows an Analytics Search scatter plot with two visually distinct groups of data points: one isolated group around the lower-left area of the chart and another dense group near the upper-right area. For KMeans clustering, the analyst must provide the number of clusters based on the observed structure of the data. The FortiSIEM 7.4 User Guide describes KMeans as “an unsupervised clustering algorithm that groups data points into user specified K groups so that each data point belongs to one group.” It also states that KMeans “tries to iteratively minimize intra-cluster distance and maximize inter-cluster distance” and notes that the user must “specify the number of clusters based on user’s knowledge of data.”

The same FortiSIEM guide explains that during Clustering Local Mode training, the analyst chooses the algorithm and, “for KMeans choose the cluster size as a guess.” In this exhibit, the natural guess is 2, because the scatter plot separates into two obvious groups. Fifty or 100 clusters would overfit the small number of visible groups, while one cluster would merge two clearly separate behaviors into a single cluster.

The correct answer is B because the automation policy shown has the email/SMS/webhook notification action enabled, and the setting that suppresses notification for manual incident clearing is not selected. The FortiSIEM Study Guide explains that automation policies define actions taken when incident-related policy criteria match. It states that notification policies are defined by criteria such as severity, associated rules, time range, affected items, and actions. The guide also states that FortiSIEM can send email notifications and SMS messages to individuals or groups as part of an automation policy. In the exhibit, the options Do not notify when an incident is cleared automatically and Do not notify when an incident is cleared by system are selected, but Do not notify when an incident is cleared manually is not selected. Because the analyst clears the incident manually, the suppression condition does not apply. Therefore, FortiSIEM sends the configured email notification to the target user, identified in the question as the SOC manager.

FortiSIEM applies tags to FortiClient EMS-managed hosts through FortiEMS integration. The FortiSIEM 7.4 User Guide states that FortiSIEM supports discovery of FortiEMS servers using the FortiEMS Management Server API with username/password authentication. That supports option A: FortiEMS API credentials must be configured on FortiSIEM. The same guide explains that after FortiEMS discovery, “FortiSIEM can tag or untag a host, using classification tags on FortiEMS server.” It further explains the ZTNA workflow: in ZTNA, these tags are imported by Fortinet devices, especially FortiGate firewalls, and referenced in ZTNA firewall rules. That supports option C: the tag value used for ZTNA classification must be available/defined for the FortiEMS tagging workflow. Option B is not the best required configuration in the question because a remediation script is an execution method, not one of the two foundational settings being asked for. Option D reverses the API relationship; FortiSIEM connects to FortiEMS using FortiEMS credentials, not FortiSIEM API credentials stored on EMS.

FortiSIEM supports both global thresholds and per-device/per-device-object thresholds for some performance events. The Study Guide states that FortiSIEM can define “per-device-object thresholds or global thresholds” for performance events, and separately explains that global thresholds are referenced by the rules engine by default. Therefore, the correct statement is that FortiSIEM uses global and per-device thresholds for performance metrics. Options A, B, and D are too restrictive or false because FortiSIEM does not use only one fixed threshold model.

The correct answer is C. SSL . FortiSIEM receives raw logs, processes them through parsers, normalizes the extracted fields, classifies the event, and stores the structured data. The Study Guide explains the FortiSIEM process flow: data is collected, processed by the parsing engine, normalized, classified, and then stored. It further states that normalization extracts individual fields from raw events and maps those fields to a common schema. The FortiSIEM 7.4 User Guide describes a parser as a file containing instructions for the parser module to convert a raw log into event attributes. In the exhibit, the raw FortiGate log includes values such as profiletype= " applist " , appcat= " Network.Service " , and app= " SSL " . The field that directly represents the application value is app= " SSL " . Therefore, the parser would use SSL to populate the normalized Application Name field. applist describes the profile type, Network.Service is the application category, and wan1 is the interface, not the application name.