NSE5_FSM-6.3 Online Practice Questions

Explanation:
Grouping Attributes in Reports: When creating reports in FortiSIEM, certain attributes can be grouped to summarize and organize the data.
Unique Attributes: Attributes that are unique for each event cannot be grouped because they do not provide a meaningful aggregation or summary.
Red Highlighting Explanation
The red highlighting in the exhibit indicates attributes that cannot be grouped together due to their unique nature. These unique attributes include Event Receive Time, Reporting IP, Event Type, Raw Event Log, and COUNT (Matched Events).
Attribute Characteristics:
Event Receive Time is unique for each event.
Reporting IP and Event Type can vary greatly, making grouping them impractical in this context.
Raw Event Log represents the unprocessed log data, which is also unique.
COUNT (Matched Events) is a calculated field, not suitable for grouping.
Reference: FortiSIEM 6.3 User Guide, Reporting section, explains the constraints on grouping attributes in reports.

Explanation:
Discovery Scan Types: FortiSIEM uses various scan types to discover devices on a network.
Layer 2 (L2) Scan: An L2 scan discovers devices based on ARP tables and MAC address information from adjacent devices.
Limitation: If a device is quiet (not actively communicating) and its entry is not present in the ARP
table of adjacent devices, the L2 scan may miss it.
Other Scan Types:
CMDB Scan: Based on the existing Configuration Management Database (CMDB) entries.
Range Scan: Scans a specified IP range for devices.
Smart Scan: Uses a combination of methods to discover devices.
Reference: FortiSIEM 6.3 User Guide, Device Discovery section, which explains the different types of discovery scans and their characteristics.

Explanation:
Incident Status Values: Incident statuses in FortiSIEM help administrators track and manage the lifecycle of incidents from detection to resolution.
Four Possible Status Values:
Active: Indicates that the incident is currently ongoing and needs attention.
Closed: Indicates that the incident has been resolved or addressed.
Cleared: Indicates that the incident has been resolved automatically based on predefined conditions.
Open: Indicates that the incident is acknowledged and under investigation but not yet resolved.
Usage: These statuses help in prioritizing and tracking incidents effectively, ensuring that all incidents are appropriately managed.
Reference: FortiSIEM 6.3 User Guide, Incident Management section, which details the different status values and their meanings.

Explanation:
Rule Subpattern Definition: In FortiSIEM, a subpattern within a rule is used to define specific conditions and criteria that must be met for the rule to trigger an incident or alert.
Components of a Subpattern: The subpattern includes the following elements:
Filters: Criteria to filter the events that the rule will evaluate.
Aggregation: Conditions that define how events should be aggregated or grouped for analysis. Time Window Definitions: Specifies the time frame over which the events will be evaluated to determine if the rule conditions are met.
Together, these components allow the system to efficiently and accurately detect patterns of interest within the event data.
Reference: FortiSIEM 6.3 User Guide, Rules and Patterns section, which explains the structure and configuration of rule subpatterns, including the use of filters, aggregation, and time window definitions.

Explanation:
WMI Method: Windows Management Instrumentation (WMI) is a set of specifications from Microsoft for consolidating the management of devices and applications in a network.
Log Collection: WMI is used to collect various types of logs from Windows devices.
Security Logs: Contains records of security-related events such as login attempts and resource access.
Application Logs: Contains logs generated by applications running on the system.
System Logs: Contains logs related to the operating system and its components.
Comprehensive Data Collection: By using WMI, FortiSIEM can gather a wide range of event logs that are crucial for monitoring and analyzing the security and performance of Windows devices.
Reference: FortiSIEM 6.3 User Guide, Data Collection Methods section, which details the use of WMI for collecting event logs from Windows devices.