Updated Jul-2026 Exam Engine for NSE6_FSM_AN-7.4 Exam Free Demo & 365 Day Updates [Q54-Q71]

July 27, 2026 admin 0 Comments

Rate this post

Updated Jul-2026 Exam Engine for NSE6_FSM_AN-7.4 Exam Free Demo & 365 Day Updates

Exam Passing Guarantee NSE6_FSM_AN-7.4 Exam with Accurate Quastions!

NO.54 Refer to the exhibit. Why is this search not producing any results?

You cannot reference both the User and Event Type attributes in the same analytics search.

You did not use the configuration management database (CMDB) group search properly.

You must set the Time Range to Real-time to identify login failures.

There is a nested query attribute type mismatch.

You must set the Operator to = for both queries.

The query contains a nested query attribute type mismatch because the User attribute is being compared against a Device IP group value. The attribute type and referenced group type must match for the search to return results.

NO.55 Refer to the exhibit.

If you group the events by Reporting Device , Reporting IP , and Application Category , how many results will FortiSIEM display?

Four

Five

One

Six

Two

FortiSIEM grouping works by combining events that have the same values for all selected Group By attributes. The Study Guide’s rule and subpattern example states that when multiple events have the same Group By values, “they are grouped together in one row, and the count column tracks the number of events for each of those rows.” In the exhibit, the selected grouping fields are Reporting Device, Reporting IP, and Application Category. The table contains six raw rows, but two rows share the same grouped combination:
FW01 / 10.1.1.1 / DB . Those two rows are collapsed into one grouped result. The other combinations are unique: FW02 / 10.1.1.2 / WebApp, FW01 / 10.1.1.1 / SSH, FW03 / 10.1.1.3 / DB, and FW04 / 10.1.1.4 / SSH. That creates five grouped rows in total. FortiSIEM does not display six because grouping removes duplicate combinations, and it does not display four because only one duplicate combination exists.

NO.56 Refer to the exhibit. Which two items can be referenced in the incident details when this rule is triggered and creates an incident? (Choose two.)

User

Reporting Device

Domain Account Lockout

Event Type

COUNT(Matched Events)

Incident details can reference attributes defined in the Group By section because those values are preserved and available when the incident is generated. In this rule, User and Reporting Device are grouped attributes and can therefore be referenced in the incident details.

NO.57 In an automation policy, which two methods can you use to notify analysts when an incident is triggered?
(Choose two.)

FortiSIEM Case

Syslog

Pop-up window

The correct answers are A. Email and B. FortiSIEM Case. FortiSIEM automation policies can notify or route work to analysts when an incident is triggered. The Study Guide describes the incident notification email workflow and explains that when an incident triggers and an automation policy is defined, FortiSIEM can send a notification email using the default template. It also explains that notification frequency is configured per rule and that repeated incident notifications are controlled by the frequency timer. The FortiSIEM 7.4 User Guide also describes automated case creation through automation policy. It states that an automation policy can use the action Create Case when an incident is created, and that a case management policy can assign FortiSIEM Analyst Teams in an ordered handling sequence. Syslog is not listed as one of the analyst notification methods in the automation policy options shown in this question; FortiSIEM supports SNMP and webhook-style actions, but not
“Syslog” as the listed answer. A pop-up window is not an automation policy notification method.
Therefore, the two correct analyst-notification/routing methods are Email and FortiSIEM Case.

NO.58 Which two elements can you use to define how an automation policy activates? (Choose two.)

Lookup table

Rules

Watchlist

Time range

NO.59 Which run mode takes the most time to perform machine learning tasks?

Local Auto

Local

Forecasting

Regression

The correct answer is Local Auto. The uploaded answer was right, but its explanation was sloppy because it incorrectly described Local mode as the most time-consuming mode. In FortiSIEM machine learning, Local Auto mode selects the best algorithm by evaluating multiple candidate algorithms. The User Guide states that in Local Auto mode, “FortiSIEM picks the best algorithm” and that the Max Run Time parameter limits how long the job can run; longer runtime can produce better results. That is why Local Auto can take the most time. Forecasting and Regression are task types, not run modes.

NO.60 Refer to the exhibit.

If you group the events by User , Source IP , and Count attributes, how many results will FortiSIEM display?

Two

Six

Three

Five

Four

Grouping by User, Source IP, and Count means that each unique combination of those three attributes will be treated as a separate result. In the table, all six rows have distinct combinations of User, Source IP, and Count
– so FortiSIEM will display 6 results.
Six because grouping by User , Source IP , and Count creates a separate result for every unique combination of those three selected attributes. The FortiSIEM Study Guide explains this grouping behavior in the single- subpattern rule example: “If multiple VPN login failure events have the same source IP address, reporting device, reporting IP address, and user, they are grouped together in one row, and the count column tracks the number of events for each of those rows.” Applying that rule here, FortiSIEM compares all selected Group By fields together. In the exhibit, every row has a unique Source IP address, even where the same user appears more than once. For example, Mike appears twice, but the Source IP and Count values are different. Alice appears twice with Count 2, but the Source IP values are different. Bob appears twice, but both Source IP and Count are different. Since no row has the same User, Source IP, and Count combination as another row, FortiSIEM displays all six rows.

NO.61 What are two required components of a rule? (Choose two.)

Exception policy

Subpattern

Detection Technology

Clear policy

A FortiSIEM rule requires detection logic and at least one subpattern structure to evaluate matching events. The FortiSIEM Study Guide explains that a single subpattern rule example consists of filter, aggregate, and group-by sections. It states: “The subpattern, ExcessVPNLoginFailure, consists of three components: Filter, Aggregate, Group By.” That confirms that a subpattern is a core rule component.
The FortiSIEM 7.4 User Guide also identifies Detection Technology as part of rule definition and built- in rule metadata. Detection Technology describes the detection method used by the rule, such as correlation, profiling, machine learning, or correlation using lookup tables. Exception policy is not required; it is used to suppress or tune matches under specific conditions. Clear policy is also not required; it controls how an incident can be cleared or auto-cleared after triggering. Therefore, the required components among the listed options are Subpattern and Detection Technology. Without them, the rule lacks both the event-detection structure and the detection-method classification needed for rule evaluation.

NO.62 Refer to the exhibits.

Three events are collected over 10 minutes from two servers: Server A and Server B.
Based on the settings for the rule subpattern and a 10-minute condition window, how many incidents will the servers generate?

Server A will not generate any incidents and Server B will not generate any incidents.

Server A will generate one incident and Server B will generate one incident.

Server A will not generate any incidents and server B will generate one incident.

Server A will generate one incident and Server B will not generate any incidents.

The rule triggers when the average CPU utilization (AVG(CPU Util)) exceeds the device’s CMDB critical threshold and there are at least two matching events within the 10-minute window.
Server A: Average CPU = (90 + 95) / 2 = 92.5, which is greater than its critical threshold of 90, and it has two events, so one incident is generated.
Server B: Average CPU = (70 + 60) / 2 = 65, which is below its critical threshold of 70, so no incident is generated.
So, Server A generates one incident, and Server B generates none.

NO.63 How does FortiSIEM update the incident table if a performance rule triggers repeatedly?

FortiSIEM changes the incident status to Repeated, and updates the Last Seen timestamp.

FortiSIEM updates the Incident Count value and Last Seen timestamp.

FortiSIEM generates a new incident based on the Rule Frequency value, and updates the First Seen and Last Seen timestamps.

FortiSIEM generates a new incident each time the rule triggers, and updates the First Seen and Last Seen timestamps.

The correct answer is B. FortiSIEM does not create a separate incident every time the same rule condition repeats. The FortiSIEM Study Guide explains that rules process events based on time periods, and if the same rule with the same incident conditions triggers repeatedly, FortiSIEM increases the count instead of creating a new incident. The incident list view includes the incident Count field for this purpose. The guide further explains that when an incident triggers for the first time, FortiSIEM sets First Occurred and Last Occurred to the same value. When the incident triggers again within the rule evaluation period, FortiSIEM increases the count and updates Last Occurred, while the triggered Events view displays the latest event data. This behavior prevents duplicate incident flooding while preserving evidence that the condition is recurring. Option A is incorrect because FortiSIEM does not use a “Repeated” incident status. Option C and D are incorrect because FortiSIEM does not generate a new incident for every repeated trigger when the incident conditions match an already active incident.

NO.64 Which items are used to define a subpattern?

Filters, Aggregate, Group By definitions

Filters, Aggregate, Time Window definitions

Filters, Group By, Threshold definitions

Filters, Threshold, Time Window definitions

The correct answer is A. Filters, Aggregate, Group By definitions. FortiSIEM rule subpatterns are built from three main configuration areas. The Study Guide states that rule conditions are built from subpatterns of event attribute filters and aggregation functions. It also explains that the single- subpattern rule example in the FortiSIEM GUI demonstrates how “filters, aggregate, and group by” come together to form a subpattern rule. Filters define which events are eligible for matching, such as Event Type, Source IP, Destination IP, or other event attributes. Aggregate defines the threshold or statistical calculation, such as COUNT(Matched Events) > = 3 or an average metric threshold. Group By defines how FortiSIEM partitions matching events into separate evaluation groups, such as by User, Source IP, Destination IP, Host Name, or Reporting Device. Time Window is part of the higher-level rule condition, not one of the three subpattern definition sections. Therefore, the exact components used to define a subpattern are Filters, Aggregate, and Group By.

NO.65 Refer to the exhibits.

You want the rule shown in the exhibit to trigger when three failed login attempts occur within 3 minutes.
Which condition time window and aggregate values are correct for your objective?

Time window 180 seconds, aggregate value 3

Time window 180 seconds, aggregate value 2

Time window 540 seconds, aggregate value 3

Time window 60 seconds, aggregate value 3

Three minutes equals 180 seconds. Because the aggregate operator shown is greater than, the matched-event count must be set to 2 so the rule triggers when the count becomes greater than
2, meaning three or more failed login attempts occur within the condition window.

NO.66 Refer to the exhibit. What does the Group: Windows value refer to?

A Windows Active Directory (AD) user group

A configuration management database (CMDB) device group

A SOC analyst group

A FortiSIEM user group

In FortiSIEM, the value Group: Windows refers to a CMDB device group containing devices categorized as Windows systems. It is used to match event attributes such as Source IP against devices in that CMDB group.

NO.67 Refer to the exhibit.

An analyst is trying to identify an issue using an expression based on the Expression Builder settings shown in the exhibit; however, the error message shown in the exhibit indicates that the expression is invalid.
What is the correct syntax to create an expression that generates a total count of matched events?

COUNT(Matched Events)

(COUNT) Matched Events

Matched Events (COUNT)

Matched Events COUNT()

The correct syntax is COUNT(Matched Events) – with proper capitalization and spacing – to generate a total count of matched events. The error in the exhibit likely stems from a formatting issue (e.g., lowercase count() or incorrect spacing), not the logical structure of the expression.
COUNT(Matched Events) . FortiSIEM uses aggregate functions inside rule subpatterns and analytics display fields to calculate values such as the number of matched events. The Study Guide explains that rule conditions are built from subpatterns of event attribute filters and aggregation functions. It also shows that the Aggregate section is where expressions such as COUNT(Matched Events) are used to define event-count thresholds. In the exhibit, the expression is intended to generate a total count of matched events. The proper function format is the aggregate function name followed by the target field inside parentheses. Therefore, COUNT(Matched Events) is syntactically valid. Options B, C, and D are invalid because they place the function name outside the standard function-call format or attach the argument incorrectly. This matters because FortiSIEM’s Expression Builder validates expressions according to function syntax. To count matched events, the function must be written as an aggregate operation over the Matched Events field.

NO.68 Refer to the exhibit.

You want to create a dashboard like the one shown in the exhibit on your FortiSIEM device.
Which item defines the data that these widgets display?

FortiSIEM reports

FortiSIEM incidents

FortiSIEM discovery rules

FortiSIEM UEBA tags

FortiSIEM dashboard widgets display data based on reports. Each widget uses an underlying report or analytics query to define the dataset, aggregation, and visualization shown on the dashboard.

NO.69 Refer to the exhibit.
The configuration for a machine learning (ML) dataset using anomaly detection is shown.

If data for this model is generated every hour, how long must the FortiSIEM device be up before it can produce a valid training set?

3 hours

10 hours

24 hours

30 hours

The Windows parameter is set to 10, meaning FortiSIEM requires 10 data windows to build a valid training baseline. Since data is generated every hour, the device must collect 10 hours of data before producing a valid training set.

NO.70 How does FortiSIEM update the incident details if the same rule triggers repeatedly?

FortiSIEM updates the Incident Count value and Last Seen timestamp.

FortiSIEM generates a new incident each time the rule triggers and updates all the First Seen and Last Seen timestamps.

FortiSIEM generates a new incident based on the Rule Frequency value, and updates the First Seen and Last Seen timestamps.

FortiSIEM changes the incident status to Repeated, and updates the Last Seen timestamp.

When the same rule triggers repeatedly for an existing incident, FortiSIEM updates the Incident Count and refreshes the Last Seen timestamp while maintaining the original incident record.

NO.71 Refer to the exhibit. What is the Group: VPN Gateway value referring to?

A watchlist

An authentication user group

A CMDB device group

A FortiGate address group

The value Group: VPN Gateway refers to a CMDB device group in FortiSIEM. This group represents a collection of devices categorized as VPN Gateways in the Configuration Management Database. By filtering with this group, the query retrieves events where the Source IP matches any device included in the CMDB group “VPN Gateway.”

Loading …