Fortinet NSE5_FSM-5.2 Online Practice Questions and Exam Preparation

Fortinet NSE5_FSM-5.2 Online Questions & Answers

• Question 1:

  Which FortiSIEM components can do performance availability and performance monitoring?

  A. Supervisor, worker, and collector
  B. Supervisor and workers only
  C. Supervisor only
  D. Collectors only
  A. Supervisor, worker, and collector

• Question 2:

  Refer to the exhibit.

  

  Three events are collected over a 10-minutc time period from two servers Server A and Server B. Based on the settings being used for the rule subpattern. how many incidents will the servers generate?

  A. Server A will not generate any incidents and Server B will not generate any incidents
  B. Server A will generate one incident and Server B wifl generate one incident
  C. Server A will generate one incident and Server B will not generate any incidents
  D. Server B will generate one incident and Server A will not generate any incidents
  A. Server A will not generate any incidents and Server B will not generate any incidents

• Question 3:

  Which three ports can be used to send Syslogs to FortiSIEM? (Choose three.)

  A. UDP9999
  B. UDP 162
  C. TCP 514
  D. UDP 514
  E. TCP 1470
  B. UDP 162
  D. UDP 514
  E. TCP 1470

• Question 4:

  Refer to the exhibit.

  

  A FortiSIEM administrator wants to collect both SIEM event logs and performance and availability metrics (PAM) events from a Microsoft Windows server. Which protocol should the administrator select in the AccessProtocol drop-down list so that FortiSIEM will collect both SIEM and PAM events?

  A. TELNET
  B. WMI
  C. LDAPS
  D. LDAP start TLS
  A. TELNET

• Question 5:

  Which two export methods are available for FortiSIEM analytics results? (Choose two.)

  A. CSV
  B. PNG
  C. HTML
  D. PDF
  A. CSV
  D. PDF

• Question 6:

  What are the four possible incident status values?

  A. Active, dosed, cleared, open
  B. Active, cleared, cleared manually, system cleared
  C. Active, closed, manual, resolved
  D. Active, auto cleared, manual, false positive
  C. Active, closed, manual, resolved

• Question 7:

  Refer to the exhibit.

  

  The FortiSIEM administrator is examining events for two devices to investigate an issue However, the administrator is not getting any results from their search. Based on the selected fillers shown in the exhibit, why is the search returning no results?

  A. Parenthesis are missing
  B. The wrong boolean operator is selected in the Next column
  C. The wrong option is selected in the Operator column
  D. An invalid IP subnet is typed in the Value column
  D. An invalid IP subnet is typed in the Value column

• Question 8:

  Refer to the exhibit.

  

  If events are grouped by Event Receive Time, Reporting IP, and User attributes in FortiSIEM, how many results will be displayed?

  A. Eight results will be displayed
  B. Four results will be displayed
  C. Two results will be displayed
  D. Unique attributes cannot be grouped
  D. Unique attributes cannot be grouped

• Question 9:

  A FortiSIEM administrator wants to restrict a network administrator to running searches for only firewall devices. Under role management, which option does the FortiSIEM administrator need to configure to achieve this scenario?

  A. CMDB Report Conditions
  B. Data Conditions
  C. UI Access
  B. Data Conditions

• Question 10:

  If an incident's status is Cleared, what does this mean?

  A. Two hours have passed since the incident occurred and the incident has not reoccurred.
  B. A clear condition set on a rule was satisfied.
  C. A security rule issue has been resolved.
  D. The incident was cleared by an operator.
  A. Two hours have passed since the incident occurred and the incident has not reoccurred.