Fortinet NSE6_FSM_AN-7.4 Exam Dumps

The correct answer is A. Design. In the FortiSIEM 7.4 User Guide's anomaly detection workflow, the first configuration step is Step 1: Design. In that step, FortiSIEM requires the analyst to identify the fields that will be analyzed by the machine learning job. The guide states that under Design, the analyst must identify Fields to Analyze, and explains that these fields are considered for anomaly detection and must currently be numerical fields. The guide also identifies the time field requirement for statistical deviation algorithms and notes that a FortiSIEM report is used to provide the dataset. The Prepare Data step comes later and is used to load or prepare the data source for training. The Train step runs the algorithm against the prepared dataset. The Schedule step is used after training to run inference. Therefore, the selection of fields to analyze belongs to the Design phase, not Prepare Data, Train, or Schedule. This sequence matters because FortiSIEM must know which numerical fields are relevant before it can prepare, train, or run inference on the machine learning job.

To detect three failed login attempts within three minutes, you must set the aggregate count to 3 in the subpattern and the time window to 180 seconds in the rule condition. This ensures the rule triggers only if three or more failed logins occur in that timeframe.

The correct answer is A because three minutes equals 180 seconds, and the aggregate threshold must be set to three matching events. The FortiSIEM Study Guide explains that rule conditions specify event attributes and thresholds that trigger the rule and create an incident. It further states that the time window defines the period within which the subpattern must match for the rule condition to be satisfied. The Study Guide's single-subpattern rule example shows the same principle: the condition has a configured time window, and the Aggregate section uses a function such as COUNT(Matched Events) to require a minimum number of matching events. In this question, the analyst wants the rule to trigger when three failed login attempts happen within three minutes. Therefore, the rule condition time window must be 180 seconds, and the aggregate count must be 3. A 90-second window would detect only events inside one and a half minutes, not the required three minutes. An aggregate count of 2 would trigger too early because the requirement is three failed attempts.

The correct answer is A. FortiSIEM supports bulk rule operations for selected rules. The FortiSIEM 7.4 User Guide states that if you have permission to activate a rule, you can activate or deactivate multiple rules with a single click. The procedure instructs the user to go to Resources > Rules, click the edit icon, select Multiple Rules, choose the rules, and then use the Select Actions panel. In that panel, the guide states that you can select a Severity from the Severity drop-down list to change the selected rules, and you can also select or deselect active status options for new or existing organizations to make the selected rules active or inactive. This proves that both operations are available: severity changes and activation/deactivation changes. Option B is too restrictive because FortiSIEM allows multiple-rule selection. Option C is incomplete because activation/deactivation is also supported. Option D is incomplete because severity changes are also supported. Therefore, the correct answer is that you can change severity and activate or deactivate multiple selected rules.

Grouping by User, Source IP, and Count means that each unique combination of those three attributes will be treated as a separate result. In the table, all six rows have distinct combinations of User, Source IP, and Count - so FortiSIEM will display 6 results.

Six because grouping by User, Source IP, and Count creates a separate result for every unique combination of those three selected attributes. The FortiSIEM Study Guide explains this grouping behavior in the single-subpattern rule example: ''If multiple VPN login failure events have the same source IP address, reporting device, reporting IP address, and user, they are grouped together in one row, and the count column tracks the number of events for each of those rows.'' Applying that rule here, FortiSIEM compares all selected Group By fields together. In the exhibit, every row has a unique Source IP address, even where the same user appears more than once. For example, Mike appears twice, but the Source IP and Count values are different. Alice appears twice with Count 2, but the Source IP values are different. Bob appears twice, but both Source IP and Count are different. Since no row has the same User, Source IP, and Count combination as another row, FortiSIEM displays all six rows.

The correct answer is C. Regression. Regression is the machine learning task used when a model predicts a target value based on other fields in a dataset. In FortiSIEM's machine learning workflow, regression configuration includes selecting Fields to use for Prediction and a Field to Predict. The User Guide explains that during regression training, the analyst chooses the fields used for prediction and the field being predicted, then trains the model with a Train factor. This matches the question exactly: the model predicts a target based on other fields, and the inference phase can identify anomalies when observed values differ significantly from predicted values. Classification is used to assign records to discrete classes or categories, not to predict a continuous target metric from other variables. Clustering groups similar observations without a predefined target field. Forecasting predicts future values over time, normally based on time-series behavior. Because the question specifically describes predicting a target field from other dataset fields and detecting mismatch from the prediction, the correct machine learning method is Regression.