NSE6_FSM_AN-7.4 Exam Preparation Material | Fortinet NSE 6 - FortiSIEM 7.4 Analyst

Explanation:
The rule is matching VPN logon failure events where the Source Country is outside the configured home country. In the exhibit, the filter section shows Event Type IN EventTypes: VPN Logon Failure and Source Country NOT IN GeoCountries: My Home. That means the source must be outside the home-country geo group. The aggregate condition shows COUNT(Matched Events) >= 3, so the rule is looking for at least three matching failed VPN logon events. The Group By section uses Source IP and User, so FortiSIEM evaluates the count per unique source IP and user combination, not by different countries.
The FortiSIEM Study Guide explains that a rule subpattern contains three components: Filter , Aggregate, and Group By. It states that the filter identifies the matching event group, the aggregate function specifies how many events must match, and Group By combines events with the same grouped attributes into one row while the count tracks those events.
Option A is wrong because the rule does not count different countries.
Options C and D are wrong because the source country is explicitly NOT IN My Home, not inside the home country.

Explanation:
The correct answer is A because CMDB objects are referenced from the Value field after selecting the appropriate event attribute and operator. The FortiSIEM Study Guide gives a structured search example that references the CMDB. In that example, the attribute is Reporting IP, the operator is IN , and the value is selected from CMDB groups such as Devices: Windows and Networks: Inside Net. The guide explains that to show events reported by Windows servers within a specific network, you set the attribute and operator first, then browse the CMDB and select the relevant CMDB group value. This confirms the workflow: the CMDB reference is chosen as the value of the condition, not as the attribute itself.
Option B is incorrect because the CMDB tab is not used to launch the analytics search this way.
Option C is not a valid workflow.
Option D is wrong because the attribute is selected from event or CMDB attribute lists, while the CMDB object or group is selected in the value field.

Explanation:
The correct answer is D. ZTNA tags. FortiSIEM 7.4 includes FortiEMS endpoint tagging integration.
The FortiSIEM 7.4 User Guide states that FortiSIEM supports discovery of FortiEMS servers by using the FortiEMS Management Server API with basic username/password authentication. It also explains that after FortiEMS discovery, FortiSIEM can tag or untag a host by using classification tags on the FortiEMS server. In a ZTNA deployment, those tags are imported by member Fortinet devices, especially FortiGate firewalls, and are referenced in ZTNA firewall rules. The guide gives a common use case in which a host is tagged as suspicious or potentially compromised so firewall rules can isolate it or allow only minimal traffic. Host software versions, FortiSIEM license information, and host login credentials are not the FortiEMS API information relevant to this ZTNA tagging workflow. The API integration supports retrieving FortiEMS-managed host context and using classification/ZTNA tags for automated response and policy enforcement.

Explanation:
The correct answer is A. FortiSIEM supports bulk rule operations for selected rules. The FortiSIEM 7.4 User Guide states that if you have permission to activate a rule, you can activate or deactivate multiple rules with a single click. The procedure instructs the user to go to Resources > Rules, click the edit icon, select Multiple Rules, choose the rules, and then use the Select Actions panel. In that panel, the guide states that you can select a Severity from the Severity drop-down list to change the selected rules, and you can also select or deselect active status options for new or existing organizations to make the selected rules active or inactive. This proves that both operations are available: severity changes and activation/deactivation changes.
Option B is too restrictive because FortiSIEM allows multiple-rule selection.
Option C is incomplete because activation/deactivation is also supported.
Option D is incomplete because severity changes are also supported.
Therefore, the correct answer is that you can change severity and activate or deactivate multiple selected rules.

Explanation:
The best answer is A. Two. The exhibit shows an Analytics Search scatter plot with two visually distinct groups of data points: one isolated group around the lower-left area of the chart and another dense group near the upper-right area. For KMeans clustering, the analyst must provide the number of clusters based on the observed structure of the data. The FortiSIEM 7.4 User Guide describes KMeans as “an unsupervised clustering algorithm that groups data points into user specified K groups so that each data point belongs to one group.” It also states that KMeans “tries to iteratively minimize intra-cluster distance and maximize inter-cluster distance” and notes that the user must “specify the number of clusters based on user’s knowledge of data.”
The same FortiSIEM guide explains that during Clustering Local Mode training, the analyst chooses the algorithm and, “for KMeans choose the cluster size as a guess.” In this exhibit, the natural guess is 2, because the scatter plot separates into two obvious groups. Fifty or 100 clusters would overfit the small number of visible groups, while one cluster would merge two clearly separate behaviors into a single cluster.