NSE6_FSM_AN-7.4 Exam Dumps and Practice Questions

FortiSIEM applies tags to FortiClient EMS-managed hosts through FortiEMS integration. The FortiSIEM 7.4 User Guide states that FortiSIEM supports discovery of FortiEMS servers using the FortiEMS Management Server API with username/password authentication. That supports option A: FortiEMS API credentials must be configured on FortiSIEM. The same guide explains that after FortiEMS discovery, ''FortiSIEM can tag or untag a host, using classification tags on FortiEMS server.'' It further explains the ZTNA workflow: in ZTNA, these tags are imported by Fortinet devices, especially FortiGate firewalls, and referenced in ZTNA firewall rules. That supports option C: the tag value used for ZTNA classification must be available/defined for the FortiEMS tagging workflow. Option B is not the best required configuration in the question because a remediation script is an execution method, not one of the two foundational settings being asked for. Option D reverses the API relationship; FortiSIEM connects to FortiEMS using FortiEMS credentials, not FortiSIEM API credentials stored on EMS.

The correct answer is A. Design. In the FortiSIEM 7.4 User Guide's anomaly detection workflow, the first configuration step is Step 1: Design. In that step, FortiSIEM requires the analyst to identify the fields that will be analyzed by the machine learning job. The guide states that under Design, the analyst must identify Fields to Analyze, and explains that these fields are considered for anomaly detection and must currently be numerical fields. The guide also identifies the time field requirement for statistical deviation algorithms and notes that a FortiSIEM report is used to provide the dataset. The Prepare Data step comes later and is used to load or prepare the data source for training. The Train step runs the algorithm against the prepared dataset. The Schedule step is used after training to run inference. Therefore, the selection of fields to analyze belongs to the Design phase, not Prepare Data, Train, or Schedule. This sequence matters because FortiSIEM must know which numerical fields are relevant before it can prepare, train, or run inference on the machine learning job.

FortiSIEM grouping works by combining events that have the same values for all selected Group By attributes. The Study Guide's rule and subpattern example states that when multiple events have the same Group By values, ''they are grouped together in one row, and the count column tracks the number of events for each of those rows.'' In the exhibit, the selected grouping fields are Reporting Device, Reporting IP, and Application Category. The table contains six raw rows, but two rows share the same grouped combination: FW01 / 10.1.1.1 / DB. Those two rows are collapsed into one grouped result. The other combinations are unique: FW02 / 10.1.1.2 / WebApp, FW01 / 10.1.1.1 / SSH, FW03 / 10.1.1.3 / DB, and FW04 / 10.1.1.4 / SSH. That creates five grouped rows in total. FortiSIEM does not display six because grouping removes duplicate combinations, and it does not display four because only one duplicate combination exists.

Grouping by User, Source IP, and Count means that each unique combination of those three attributes will be treated as a separate result. In the table, all six rows have distinct combinations of User, Source IP, and Count - so FortiSIEM will display 6 results.

Six because grouping by User, Source IP, and Count creates a separate result for every unique combination of those three selected attributes. The FortiSIEM Study Guide explains this grouping behavior in the single-subpattern rule example: ''If multiple VPN login failure events have the same source IP address, reporting device, reporting IP address, and user, they are grouped together in one row, and the count column tracks the number of events for each of those rows.'' Applying that rule here, FortiSIEM compares all selected Group By fields together. In the exhibit, every row has a unique Source IP address, even where the same user appears more than once. For example, Mike appears twice, but the Source IP and Count values are different. Alice appears twice with Count 2, but the Source IP values are different. Bob appears twice, but both Source IP and Count are different. Since no row has the same User, Source IP, and Count combination as another row, FortiSIEM displays all six rows.

When an associated rule triggers, FortiSIEM performs all selected actions in the automation policy. In this case, it will send an email/SMS/webhook, run the remediation script, invoke the integration policy (even if none is currently defined), and create a case. All checked actions are executed.

The correct answer is B because FortiSIEM automation policies are designed to execute the actions selected in the policy when the policy criteria match. The FortiSIEM Study Guide states that automation policy actions define what occurs when policy criteria match. It lists possible automation actions such as sending an alert, invoking an integration policy, sending SNMP or HTTPS XML notifications, opening a remedy ticket or creating a FortiSIEM case, sending email or SMS, and running a remediation script. The same Study Guide explains that users can configure ''any combination of actions.'' Therefore, there is no single-action precedence rule where remediation overrides all other selected actions or email runs only because it appears first. If multiple action checkboxes are selected, FortiSIEM executes the configured selected actions according to the automation policy. In the exhibit, multiple actions are selected, including email/SMS/webhook, remediation/script, integration policy, and case creation. Option C is incorrect because the absence of a defined integration policy does not make FortiSIEM ignore the other selected actions. The policy runs the selected configured actions.