NSE6_FSM_AN-7.4 시험 - Fortinet실제시험문제와 답 - 37문항

Question No : 1

A rule should detect administrative logons from nonapproved sources. Approved jump hosts are stored in a lookup table.
What should the rule compare?

A.User role to severity
B.Source host to lookup
C.Target host to parser
D.Event type to report

정답:
Explanation:
The detection depends on whether the logon source is an approved jump host. The source host should be compared against the lookup table. The other comparisons do not identify approved or unapproved logon sources.

Question No : 2

A correlation rule has two subpatterns, but the second subpattern matches events from any host instead of the host found in the first subpattern.
What is missing?

A.A clear-condition timer
B.A notification template
C.A shared field constraint
D.A report output filter

정답:
Explanation:
Subpatterns must share a constrained field, such as host or user, to ensure the second pattern matches the same entity as the first. Without that constraint, unrelated events can satisfy the rule.

Question No : 3

A rule stopped triggering after the SOC added an exclusion for approved jump hosts. Manual searches still show suspicious activity from unapproved hosts.
What should be checked first?

A.Incident severity value
B.Notification recipient
C.Dashboard filter scope
D.Exclusion logic scope

정답:
Explanation:
If valid activity stops matching after an exclusion is added, the exclusion logic may be too broad or mapped to the wrong field. Severity, recipients, and dashboard filters do not prevent the rule from matching events.

Question No : 4

A rule should identify a source IP that fails authentication against more than 20 unique accounts.
Which aggregation is required?

A.Distinct account count
B.Latest failure time
C.Average event severity
D.Target host count

정답:
Explanation:
The detection requires counting unique accounts targeted by the same source IP. A total event count could be caused by repeated failures against one account, which is a different pattern.

Question No : 5

A rule creates one incident for each destination IP contacted by the same infected host. The SOC wants one incident per infected host instead.
What should be changed?

A.Add a notification delay
B.Adjust destination grouping
C.Raise the event threshold
D.Change incident severity

정답:
Explanation:
If destination IP is part of the group-by logic, FortiSIEM can split activity into separate incidents per destination. Adjusting the destination grouping helps combine related activity under the infected host.

Question No : 6

A rule should identify DNS traffic to unapproved resolvers. Approved DNS resolver IPs are stored in a lookup table.
Which rule condition best fits?

A.Source in DNS lookup
B.DNS count over threshold
C.Destination not in lookup
D.Resolver grouped by user

정답:
Explanation:
The rule should alert when the DNS destination is outside the approved resolver list. Matching approved destinations would show expected behavior, and grouping alone would not detect the exception.

Question No : 7

A rule uses a lookup table of high-value servers, but it triggers for noncritical systems. The lookup table is correct.
What should the analyst verify next?

A.Incident clear policy
B.Lookup refresh time
C.Rule threshold value
D.Rule field mapping

정답:
Explanation:
If the lookup table is correct but the rule matches the wrong systems, the rule may be comparing the lookup to the wrong field. The analyst should verify whether the target IP or host field is mapped correctly.

Question No : 8

A port-scan rule counts denied firewall events but does not distinguish a source that hits many ports from one that repeats a single port.
What should be added?

A.Distinct port aggregation
B.Destination host display
C.Longer time retention
D.Incident status filter

정답:
Explanation:
Port scanning requires measuring port diversity. A distinct port aggregation is better than a simple event count when deciding whether many ports were contacted.

Question No : 9

A rule should trigger only when failed logins exceed a threshold for the same source IP and target host pair.
Which configuration is most important?

A.Display field selection
B.Correct group-by fields
C.Incident owner mapping
D.Notification delay time

정답:
Explanation:
The source IP and target host must be included in the group-by logic so the threshold is evaluated per pair. Display, owner, and notification settings do not define how the threshold is grouped.

Question No : 10

A newly created rule triggers on many unrelated firewall events because it uses only a broad normalized event type.
What should the analyst do first?

A.Add report-level filtering
B.Increase rule severity
C.Add specific conditions
D.Shorten event retention

정답:
Explanation:
A broad event type can match too many events. Adding specific conditions such as action, direction, port, source, or destination improves precision. Report filters and severity changes do not improve rule matching.

Question No : 11

An analyst wants each incident to represent suspicious activity for one user, even when the user appears on multiple devices.
Which grouping is most appropriate?

A.Group by device vendor
B.Group by parser name
C.Group by target host
D.Group by user identity

정답:
Explanation:
Grouping by user identity keeps activity tied to the user across devices. Device, parser, or target-host grouping would split the activity by infrastructure rather than the user entity.

Question No : 12

A rule should detect one user logging in to many different hosts within 10 minutes.
Which aggregation best supports this detection?

A.Distinct host count
B.Latest event time
C.Average event severity
D.Total raw log count

정답:
Explanation:
The suspicious behavior is one user reaching many unique hosts. A distinct host count measures that spread. A total event count could trigger on repeated activity against one host and miss the intended behavior.

Question No : 13

A SOC team wants a rule to detect hosts that first generate endpoint malware events and then make outbound connections to suspicious countries.
Which rule design is strongest?

A.Endpoint-only rule with host count
B.Two linked subpatterns
C.Firewall-only rule with country group
D.Lookup-only country filter

정답:
Explanation:
The requirement involves two related behaviors from the same host. Two linked subpatterns can correlate endpoint malware activity with later outbound network connections.

Question No : 14

A correlation rule is designed to detect five failures followed by one success. Testing shows the events match individually, but the rule does not trigger because the success occurs after the current evaluation period.
What should be adjusted?

A.Group-by field order
B.Lookup table scope
C.Incident clear method
D.Rule time window

정답:
Explanation:
If related events occur outside the evaluation period, the rule cannot correlate them. Adjusting the time window is the relevant fix. Grouping and lookup scope may affect matching, but they do not solve a timing miss.

Question No : 15

A failed-login rule fires during normal backup activity because known service accounts authenticate repeatedly. The events should remain searchable, but the rule should not alert on them.
What is the best tuning action?

A.Exclude known accounts
B.Reduce the threshold only
C.Change the incident owner
D.Remove source grouping

정답:
Explanation:
Excluding known service accounts from the rule condition reduces expected noise while preserving event collection. Reducing the threshold would likely increase noise, and changing owner or grouping does not address the known-account exception.

Fortinet NSE6_FSM_AN-7.4 시험