Fortinet NSE6_FSM_AN-7.4 Dumps - Pass Fortinet NSE 6 - FortiSIEM 7.4 Analyst Exam in First Attempt 2026

The correct answer is B because the configuration groups results by Source IP and Destination IP, while using COUNT(Matched Events) as a display/aggregate value. FortiSIEM's grouping logic combines events only when the selected Group By attributes match. The Study Guide explains that Group By attributes determine how matching events are placed into rows, and that when multiple events share the same grouped values, ''they are grouped together in one row.'' The count column then tracks the number of events represented by that row. In the exhibit, Source IP and Destination IP are the grouping fields, so FortiSIEM displays each unique connection pair once. The count shows how many matching allowed firewall connection events were seen for each pair. Option A is not correct because the exhibit does not show sorting by destination IP hit count. Option C ignores the source and destination grouping. Option D would require grouping by source IP alone or by distinct destination counts per source, which is not the shown configuration.

The automation policy is configured to run a remediation script named 'Fortinet FortiOS - Block Source IP FortiOS via API'. It specifies enforcement on two FortiGate devices: FortiGate508 and FortiGate90D. Therefore, associated source IP addresses will be blocked on those two FortiGate firewalls only.

The correct answer is D because the remediation configuration defines specific enforcement targets. The FortiSIEM Study Guide explains that automation policies can run remediation scripts automatically when an incident occurs. It also explains the remediation options: Enforce On determines which devices the script runs against, while Run On identifies whether the script is launched from the supervisor or a collector. The Study Guide further states that mitigation scripts can block an IP address in a firewall or disable a user in Active Directory, and recommends specifying the Enforce On value because it controls the target device used by the remediation script. In the exhibit, the selected script is a Fortinet FortiOS block-source-IP remediation script, and the Enforce On field lists two FortiGate devices. That means the block action is targeted only at those two named FortiGate firewalls. The Aviation organization limits the automation policy context, but it does not mean every device in the organization receives the block. It is also not all FortiGate firewalls or the whole Network CMDB group.

The correct answer is A. Filters, Aggregate, Group By definitions. FortiSIEM rule subpatterns are built from three main configuration areas. The Study Guide states that rule conditions are built from subpatterns of event attribute filters and aggregation functions. It also explains that the single-subpattern rule example in the FortiSIEM GUI demonstrates how ''filters, aggregate, and group by'' come together to form a subpattern rule. Filters define which events are eligible for matching, such as Event Type, Source IP, Destination IP, or other event attributes. Aggregate defines the threshold or statistical calculation, such as COUNT(Matched Events) >= 3 or an average metric threshold. Group By defines how FortiSIEM partitions matching events into separate evaluation groups, such as by User, Source IP, Destination IP, Host Name, or Reporting Device. Time Window is part of the higher-level rule condition, not one of the three subpattern definition sections. Therefore, the exact components used to define a subpattern are Filters, Aggregate, and Group By.

The rule is matching VPN logon failure events where the Source Country is outside the configured home country. In the exhibit, the filter section shows Event Type IN EventTypes: VPN Logon Failure and Source Country NOT IN GeoCountries: My Home. That means the source must be outside the home-country geo group. The aggregate condition shows COUNT(Matched Events) >= 3, so the rule is looking for at least three matching failed VPN logon events. The Group By section uses Source IP and User, so FortiSIEM evaluates the count per unique source IP and user combination, not by different countries.

The FortiSIEM Study Guide explains that a rule subpattern contains three components: Filter, Aggregate, and Group By. It states that the filter identifies the matching event group, the aggregate function specifies how many events must match, and Group By combines events with the same grouped attributes into one row while the count tracks those events.

Option A is wrong because the rule does not count different countries. Options C and D are wrong because the source country is explicitly NOT IN My Home, not inside the home country.

FortiSIEM applies tags to FortiClient EMS-managed hosts through FortiEMS integration. The FortiSIEM 7.4 User Guide states that FortiSIEM supports discovery of FortiEMS servers using the FortiEMS Management Server API with username/password authentication. That supports option A: FortiEMS API credentials must be configured on FortiSIEM. The same guide explains that after FortiEMS discovery, ''FortiSIEM can tag or untag a host, using classification tags on FortiEMS server.'' It further explains the ZTNA workflow: in ZTNA, these tags are imported by Fortinet devices, especially FortiGate firewalls, and referenced in ZTNA firewall rules. That supports option C: the tag value used for ZTNA classification must be available/defined for the FortiEMS tagging workflow. Option B is not the best required configuration in the question because a remediation script is an execution method, not one of the two foundational settings being asked for. Option D reverses the API relationship; FortiSIEM connects to FortiEMS using FortiEMS credentials, not FortiSIEM API credentials stored on EMS.