Fortinet NSE 6 - FortiSIEM 7.4 Analyst 認定 NSE6_FSM_AN-7.4 試験問題:

1. Refer to the exhibit.
The configuration for a machine learning (ML) dataset using anomaly detection is shown.

If data for this model is generated every hour, how long must the FortiSIEM device be up before it can produce a valid training set?

A) 30 hours
B) 24 hours
C) 3 hours
D) 10 hours

2. Refer to the exhibits.

Three events are collected over 10 minutes from two servers: Server A and Server B.
Based on the settings for the rule subpattern and a 10-minute condition window, how many incidents will the servers generate?

A) Server A will generate one incident and Server B will generate one incident.
B) Server A will not generate any incidents and server B will generate one incident.
C) Server A will not generate any incidents and Server B will not generate any incidents.
D) Server A will generate one incident and Server B will not generate any incidents.

3. You need a model that predicts a target field based on other fields in a dataset and then triggers an anomaly if the value does not match the prediction. Which machine learning (ML) algorithm will you use to build this type of model?

A) Forecasting
B) Classification
C) Regression
D) Anomaly detection

4. You want to reference the first source IP address from an incident in a playbook. Which option shows the correct Jinja syntax for using a variable for the source IP address in a FortiSIEM playbook?

A) srcIpAddr.records[0]
B) record(srcIpAddr)
C) vars.input.records[0].srcIpAddr
D) srcIpAddr(1)

5. An analyst wants to create a rule from a new analytic search they just performed. Which method is the most efficient way for you to create the rule?

A) Save the search as a template, and create a new rule from the template.
B) Manually re-create the analytics search in the rule configuration.
C) Make a new rule using the Create Rule option in the Actions menu.
D) Copy and paste the raw analytics search text into a rule subpattern.

質問と回答：