[Oct-2026 Newly Released] Pass NSE6_FSM_AN-7.4 Exam - Real Questions & Answers [Q43-Q65]

[Oct-2026 Newly Released] Pass NSE6_FSM_AN-7.4 Exam – Real Questions & Answers [Q43-Q65]

October 23, 2026 admin 0 Comments

Rate this post

[Oct-2026 Newly Released] Pass NSE6_FSM_AN-7.4 Exam – Real Questions and Answers

Pass NSE6_FSM_AN-7.4 Review Guide, Reliable NSE6_FSM_AN-7.4 Test Engine

Fortinet NSE6_FSM_AN-7.4 Exam Syllabus Topics:

Section	Objectives
FortiEDR Security Settings and Policies	– Security configuration 1. Configure communication control policy 2. Configure security policies 3. Explain Fortinet Cloud Service (FCS) 4. Configure playbooks
Rules and Subpatterns	– Analytics rules configuration 1. Configure FortiSIEM analytics rules 2. Identify rule components 3. Use rule subpatterns, aggregation, and group by
Incidents, Notifications, and Remediation	– Incident management 1. Configure notification policies 2. Configure remediation options 3. Manage and tune incidents
Machine Learning, UEBA, and ZTNA	– Advanced analytics integration 1. Describe ZTNA integration in FortiSIEM operations 2. Integrate UEBA data into rules and dashboards 3. Configure ML configuration tasks
Analytics	– Query and event analysis 1. Build queries from search results and events 2. Apply group by and data aggregation on search results 3. Perform nested query lookups 4. Perform CMDB and lookup table queries

Q43. Refer to the exhibit. What will FortiSIEM display if you apply the Group By and Display Fields configuration to a list of allowed firewall connections?

A list of connections between unique source and destination IP addresses

A running count of connections, regardless of source or destination

A list of connections ordered by destination IP address hit count

A list of connections ordered by the number of unique connections started by each source IP address

With Source IP and Destination IP as grouping attributes, and COUNT(Matched Events) included, FortiSIEM will display a list of unique source-destination IP pairs along with the number of allowed connections between each pair. This configuration summarizes connection activity by unique communication paths.

Q44. An analyst wants to create a rule from a new analytic search they just performed. Which method is the most efficient way for you to create the rule?

Save the search as a template, and create a new rule from the template.

Make a new rule using the Create Rule option in the Actions menu.

Manually re-create the analytics search in the rule configuration.

Copy and paste the raw analytics search text into a rule subpattern.

Using the Create Rule option directly from the Actions menu is the most efficient method because it automatically converts the existing analytic search into a rule structure without requiring manual reconfiguration.

Q45. Refer to the exhibit.

The configuration shown in the exhibit is incorrect.
What must you change to allow this configuration to be successfully applied to FortiSIEM?

The Train factor must be 70% or greater.

Run Mode must be set to ML.

Only one AVG type field must be selected under Fields to use for Prediction.

The selection in Fields to use for Prediction and Field to Predict must match.

The Run Mode is set to Local, which is not valid for training machine learning models in FortiSIEM. To apply this configuration correctly, the Run Mode must be set to ML, which enables proper model training and prediction using selected fields.

Q46. Refer to the exhibit.

An analyst is troubleshooting the rule shown in the exhibit. It is not generating any incidents, but the filter parameters are generating events on the Analytics tab.
What is wrong with the rule conditions?

The Event Type refers to a CMDB lookup and should be an Event lookup.

The Destination Host Name value is not fully qualified.

The Group By attributes restricts which events are counted.

The Aggregate attribute is too restrictive.

The correct answer is C because the rule’s Group By attributes determine how events are grouped before the aggregate condition is evaluated. The Study Guide explains that rule conditions are built from subpatterns consisting of event attribute filters and aggregation functions. It also explains that a subpattern combines filters, aggregate, and group by fields to form the rule logic. In this case, the filters may return matching events in Analytics, but the rule still may not trigger because the aggregate condition is calculated separately for each unique Group By combination. The exhibit groups by Destination IP and User while applying COUNT(Source IP) > = 2. This means FortiSIEM does not count all matching events together. Instead, it counts only events that share the same Destination IP and User combination. If no single grouped combination reaches the aggregate threshold, no incident is created. The issue is not the event lookup, not the Destination Host Name format, and not necessarily the aggregate expression itself. The grouping logic is what restricts the counted event set.

Q47. What can you use to send data to FortiSIEM for user and entity behavior analytics (UEBA)?

FortiSIEM agent

SNMP

SSH

FortiSIEM worker

Q48. Several new internal servers are generating incidents and must be excluded from several FortiSIEM rules. How must you tune rules to exclude several undiscovered devices from rules?

Add the devices to a rule exclusion automation policy.

Add their associated discovery credentials.

Add them to the global exclusion list.

Add them to a device group that is being filtered by the rules.

Creating a device group containing the servers and applying that group as a filter exclusion in the relevant rules is the proper tuning method for excluding multiple undiscovered devices from generating incidents across several rules.

Q49. Refer to the exhibits.

You are troubleshooting why the rule shown in the exhibit is generating incidents for successful Remote Desktop Protocol (RDP) connections with correct logins. It should only be triggering when a person fails a login three or more times to the target device when connecting with RDP.
What is causing the rule to be triggered by correct login events?

The attribute types in the subpatterns do not match

The RDP login is different from the login used to access the target device.

The subpattern relationship RDP_Connection:User = Failed_Logon:User never matches.

The Boolean between the subpatterns is incorrect.

The rule uses OR between the RDP connection subpattern and the failed logon subpattern, so either subpattern can trigger the rule independently. This allows successful RDP connection events to generate incidents even when the failed logon condition is not met.

Q50. When configuring machine learning (ML), in which step can you modify how the model fits the training data set?

Prepare Data

Train

Statistics

Design

The correct answer is B. Train. In FortiSIEM machine learning, the Train step is where the model is built from the prepared dataset and where model-fitting behavior can be adjusted. The FortiSIEM 7.4 User Guide explains that after preparing data, the analyst goes to Analytics > Machine Learning > Train, selects the machine learning task, chooses the algorithm, selects the prediction/target fields when required, and chooses the Train factor, which determines how much data is used for training versus testing. The guide states that the Train factor should be greater than 70%, meaning 70% of the data is used for training and 30% for testing. It also explains that model quality metrics show how accurately the algorithm predicts the field. For regression, lower MAE means a better fit, and R2 shows how well predictions approximate real data points. Most importantly, the guide states: “If you want to change the algorithm parameters and re-train, then click Tune & Train, change the parameters and click Save
& Train.” This confirms that modifying how the model fits the training dataset is done in the Train step, not Prepare Data, Statistics, or Design.

Q51. Refer to the exhibit. Why are some of the fields highlighted in red?

The Event Receive Time attribute is a valid choice to sort by.

The attribute COUNT(Matched Events) is an invalid expression.

No Raw Event Log attribute information is available.

Multiple unique values cannot be grouped.

The highlighted fields represent attributes that contain multiple unique values and therefore cannot be used together in a grouped aggregation display in the current configuration.

Q52. Which three types of data can you use to train FortiSIEM machine learning (ML)? (Choose three.)

CSV files

FortiSIEM analytical reports

FortiSIEM ML job

SQL database

Configuration management database (CMDB)

FortiSIEM machine learning models can be trained using structured data from CSV files, FortiSIEM analytical reports, and SQL database sources. These sources provide the historical datasets needed to prepare, train, and evaluate the ML model.

Q53. Which two data areas can you use for user and entity behavior analytics (UEBA) machine learning models? (Choose two.)

location

resources

process

network

FortiSIEM’s UEBA models analyze user and entity behavior by correlating data such as location (for detecting unusual logins or access patterns) and network activity (for identifying abnormal communication or traffic behaviors). These data areas enable the system to build baseline profiles and detect anomalies indicating potential insider threats or compromised accounts.

Q54. Refer to the exhibit.

A FortiSIEM device is receiving syslog events from a FortiGate firewall. The FortiSIEM analyst is trying to search the raw event logs for the last two hours that contain the keyword ” udp ” . However, they are getting no results from the search, which they know should be available. Based on the filter shown in the exhibit, why are there no search results?

The analyst selected AND in the Next column. This is the wrong Boolean operator.

The Time Range value should be set to Real-Time.

The keyword is case sensitive. Instead of typing udp in the Value field, the analyst should type UDP.

The analyst selected = in the Operator column. That is the wrong operator.

The operator is set to ” = ” , which performs an exact match on the entire raw event log, not a substring search. To find logs that contain the keyword ” udp ” , the analyst should use the CONTAIN operator instead.
This will return all logs where ” udp ” appears anywhere in the raw log message.
The correct answer is D because the analyst is trying to search for raw logs that contain the keyword udp, but the filter uses the equality operator. The FortiSIEM Study Guide explains keyword searches in terms of Raw Event Log CONTAIN logic. In the keyword phrase search section, the guide states that without quotes, FortiSIEM searches raw event logs by using conditions such as Raw Event Log CONTAIN TCP OR Raw Event Log CONTAIN connection . Another analytics example explains that searching for TCP or UDP events uses the raw event log containing the keyword tcp or udp and that the search returns case-insensitive results for TCP and UDP. This directly eliminates option C. The time range is already set to the last two hours, which is correct for historical raw log searching. The problem is the operator. To find a keyword anywhere inside a raw log message, the analyst should use CONTAIN , not =.

Q55. Refer to the exhibit.

If you group the events by Reporting Device , Reporting IP , and Application Category , how many results will FortiSIEM display?

Four

Five

One

Six

Two

FortiSIEM grouping works by combining events that have the same values for all selected Group By attributes. The Study Guide’s rule and subpattern example states that when multiple events have the same Group By values, “they are grouped together in one row, and the count column tracks the number of events for each of those rows.” In the exhibit, the selected grouping fields are Reporting Device, Reporting IP, and Application Category. The table contains six raw rows, but two rows share the same grouped combination:
FW01 / 10.1.1.1 / DB . Those two rows are collapsed into one grouped result. The other combinations are unique: FW02 / 10.1.1.2 / WebApp, FW01 / 10.1.1.1 / SSH, FW03 / 10.1.1.3 / DB, and FW04 / 10.1.1.4 / SSH. That creates five grouped rows in total. FortiSIEM does not display six because grouping removes duplicate combinations, and it does not display four because only one duplicate combination exists.

Q56. In an automation policy, which two methods can you use to notify analysts when an incident is triggered? (Choose two.)

FortiSIEM Case

Syslog

Pop-up window

In FortiSIEM automation policies, analysts can be notified of triggered incidents through FortiSIEM Case (which creates and assigns a case for follow-up) and Email notifications (which send alerts directly to recipients). These methods ensure prompt awareness and response to security events.

Q57. How does FortiSIEM update the incident table if a performance rule triggers repeatedly?

FortiSIEM changes the incident status to Repeated, and updates the Last Seen timestamp.

FortiSIEM updates the Incident Count value and Last Seen timestamp.

FortiSIEM generates a new incident based on the Rule Frequency value, and updates the First Seen and Last Seen timestamps.

FortiSIEM generates a new incident each time the rule triggers, and updates the First Seen and Last Seen timestamps.

The correct answer is B. FortiSIEM does not create a separate incident every time the same rule condition repeats. The FortiSIEM Study Guide explains that rules process events based on time periods, and if the same rule with the same incident conditions triggers repeatedly, FortiSIEM increases the count instead of creating a new incident. The incident list view includes the incident Count field for this purpose. The guide further explains that when an incident triggers for the first time, FortiSIEM sets First Occurred and Last Occurred to the same value. When the incident triggers again within the rule evaluation period, FortiSIEM increases the count and updates Last Occurred, while the triggered Events view displays the latest event data. This behavior prevents duplicate incident flooding while preserving evidence that the condition is recurring. Option A is incorrect because FortiSIEM does not use a “Repeated” incident status. Option C and D are incorrect because FortiSIEM does not generate a new incident for every repeated trigger when the incident conditions match an already active incident.

Q58. In an automation policy, which two methods can you use to notify analysts when an incident is triggered?
(Choose two.)

FortiSIEM Case

Syslog

Pop-up window

The correct answers are A. Email and B. FortiSIEM Case. FortiSIEM automation policies can notify or route work to analysts when an incident is triggered. The Study Guide describes the incident notification email workflow and explains that when an incident triggers and an automation policy is defined, FortiSIEM can send a notification email using the default template. It also explains that notification frequency is configured per rule and that repeated incident notifications are controlled by the frequency timer. The FortiSIEM 7.4 User Guide also describes automated case creation through automation policy. It states that an automation policy can use the action Create Case when an incident is created, and that a case management policy can assign FortiSIEM Analyst Teams in an ordered handling sequence. Syslog is not listed as one of the analyst notification methods in the automation policy options shown in this question; FortiSIEM supports SNMP and webhook-style actions, but not
“Syslog” as the listed answer. A pop-up window is not an automation policy notification method.
Therefore, the two correct analyst-notification/routing methods are Email and FortiSIEM Case.

Q59. Refer to the exhibit.

Which two actions can you select in an automation policy to trigger an API call to block an IP address on a FortiGate? (Choose two.)

Open Remedy ticket using the configuration set in Analytics.

Send Email/SMS/Webhook to the target users.

Invoke an Integration Policy.

Run Remediation/Script.

Run Playbook on Incident Trigger.

The correct answers are D. Run Remediation/Script and E. Run Playbook on Incident Trigger .
FortiSIEM can block an IP address on a FortiGate through a remediation script or through a FortiSOAR playbook/connector workflow. The FortiSIEM Analyst Study Guide explains that for automatic remediation, you define a remediation script for a scenario, and that mitigation scripts can “block an IP address in a firewall” or disable a user in Active Directory. It also states that, when an automation policy is triggered and the remediation script option is enabled, FortiSIEM uses incident data and runs the script to quarantine or block the offending IP address on FortiGate.
FortiSIEM 7.4 also supports automatic playbook execution from an automation policy. The 7.4 User Guide states that under Admin > Settings > Automation Policy , you can choose Run Playbook on Incident Trigger and select a playbook. The same guide explains that FortiSOAR playbooks can call connectors, and the Fortinet FortiOS connector can perform actions such as Block IP Address on a FortiGate firewall.
Email, Remedy tickets, and generic integration policies are notification/ticketing workflows, not the direct FortiGate IP-block actions.

Q60. Which two data areas can you use for user and entity behavior analytics (EBA) machine learning models?
(Choose two.)

Process

Location

Resources

Network

The correct answers are A. Process and C. Resources. FortiSIEM UEBA/EBA analytics uses endpoint and behavior-related telemetry to identify abnormal activity. The Study Guide explains that the UEBA incident dashboard shows incidents that the AI module creates based on alerts received from FortiInsight. The UEBA attribute list includes the incident name, host, application, user, tag, and activity. This aligns with process-oriented activity monitoring from endpoint agents. The performance and baseline lessons also explain that FortiSIEM collects performance and availability data from devices and applications, including resource-utilization metrics, and uses that information to build baselines and detect anomalous activity. Resource behavior includes CPU, memory, disk, I/O, and similar utilization patterns, which are valid behavioral-model inputs. Location and Network are important FortiSIEM context areas, but in this question’s EBA machine learning model choices, the valid model areas are process behavior and resource behavior. Process reflects what is running or being executed; Resources reflects system or application utilization behavior. Together, these are the two data areas used for EBA machine learning models.

Q61. Which run mode takes the most time to perform machine learning tasks?

Local Auto

Local

Forecasting

Regression

The correct answer is Local Auto. The uploaded answer was right, but its explanation was sloppy because it incorrectly described Local mode as the most time-consuming mode. In FortiSIEM machine learning, Local Auto mode selects the best algorithm by evaluating multiple candidate algorithms. The User Guide states that in Local Auto mode, “FortiSIEM picks the best algorithm” and that the Max Run Time parameter limits how long the job can run; longer runtime can produce better results. That is why Local Auto can take the most time. Forecasting and Regression are task types, not run modes.

Q62. How can you query the configuration management database (CMDB) in an analytics search?

Click Value > Select from CMDB.

On the CMDB tab, select an entry, and then click Create Search.

On the Admin tab, click CMDB Search.

Click Attribute > Select from CMDB.

In an analytics search, you can query the CMDB by clicking Value > Select from CMDB, which allows you to choose values directly from CMDB entries for the selected attribute, enabling precise filtering based on asset data.

Q63. When configuring anomaly detection machine learning, in which step must you select the fields to analyze?

Design

Schedule

Prepare Data

Train

The correct answer is A. Design. In the FortiSIEM 7.4 User Guide’s anomaly detection workflow, the first configuration step is Step 1: Design. In that step, FortiSIEM requires the analyst to identify the fields that will be analyzed by the machine learning job. The guide states that under Design, the analyst must identify Fields to Analyze, and explains that these fields are considered for anomaly detection and must currently be numerical fields. The guide also identifies the time field requirement for statistical deviation algorithms and notes that a FortiSIEM report is used to provide the dataset. The Prepare Data step comes later and is used to load or prepare the data source for training. The Train step runs the algorithm against the prepared dataset. The Schedule step is used after training to run inference.
Therefore, the selection of fields to analyze belongs to the Design phase, not Prepare Data, Train, or Schedule. This sequence matters because FortiSIEM must know which numerical fields are relevant before it can prepare, train, or run inference on the machine learning job.

Q64. You want FortiSIEM to automatically add three zero trust network access (ZTNA) tags to a device when that device triggers a custom rule. You want FortiSIEM to push these ZTNA tags to multiple FortiClient EMS servers in the organization. How can you accomplish this?

Create a syslog connection from the FortiClient EMS servers to retrieve ZTNA tag information from FortiSIEM.

Create multiple playbooks, one for each FortiClient EMS server, each with a connector for a ZTNA tag.

Create a single playbook with multiple connectors, one for each FortiClient EMS.

Create multiple automation policies, each one pushing a tag to a different FortiClient EMS server.

A single playbook can contain multiple connectors, allowing FortiSIEM to push the required ZTNA tags simultaneously to multiple FortiClient EMS servers when the custom rule is triggered.

Q65. Refer to the exhibit.

An analyst wants the rule shown in the exhibit to trigger when three failed login attempts occur within three minutes.
What should the values be for the condition time window and aggregate count?

Time window 180 seconds, aggregate count 3

Time window 180 seconds, aggregate count 2

Time window 90 seconds, aggregate count 3

Time window 90 seconds, aggregate count 2

To detect three failed login attempts within three minutes, you must set the aggregate count to 3 in the subpattern and the time window to 180 seconds in the rule condition. This ensures the rule triggers only if three or more failed logins occur in that timeframe.

Loading …

100% Free NSE6_FSM_AN-7.4 Daily Practice Exam With 94 Questions: https://www.topexamcollection.com/NSE6_FSM_AN-7.4-vce-collection.html

NSE6_FSM_AN-7.4 Practice Tests

Updated Jul-2026 Exam Engine for NSE6_FSM_AN-7.4 Exam Free Demo & 365 Day Updates [Q54-Q71]
[Oct-2026 Newly Released] Pass NSE6_FSM_AN-7.4 Exam – Real Questions & Answers [Q43-Q65]

Related Certifications

NSE5_FMG-7.2
NSE6_WCS-7.0
NSE5_FAZ-7.0
NSE5_FMG-7.0
NSE5_FMG-6.4
NSE6_FWB-6.1
NSE6_FSW-7.2
FCP_FMG_AD-7.6
NSE6_FAC-6.4
NSE6_FAC-6.1