[Q42-Q57] Try 100% Updated NSE6_FSM_AN-7.4 Exam Questions [2026]

Rate this post

Try 100% Updated NSE6_FSM_AN-7.4 Exam Questions [2026]

Pass NSE6_FSM_AN-7.4 Exam – Real Questions and Answers

NO.42 Refer to the exhibit.

An incorrect configuration is shown.
Which setting must you change to successfully apply this configuration to FortiSIEM?

Select the same values in the Fields to use for Prediction and Field to Predict sections.

Set the Run Mode to ML.

Set the Train factor to 70% or greater.

Set the algorithm to Anomaly Detection.

NO.43 Where must you define and assign a custom python script as a remediation action?

Remediation Policy

Automation Policy

Script Policy

Rule Engine Policy

NO.44 Refer to the exhibit. If a user account is locked after five failed login attempts, how many times will this rule be triggered if three individual users all fail their login 10 times?

Five

One

Fifteen

Three

NO.45 Refer to the exhibit.

If a rule containing the automation policy shown in the exhibit triggers, what will happen?

Associated source IP addresses will be blocked on devices in the Aviation organization.

Associated source IP addresses will be blocked on all FortiGate firewalls.

Associated source IP addresses will be blocked on devices in the Network CMDB group.

Associated source IP addresses will be blocked on two FortiGate firewalls.

NO.46 What are the four incident status values on FortiSIEM?

Active, cleared, cleared manually, false positive

Active, auto cleared, cleared manually, system cleared

Active, closed, cleared, resolved

Active, auto closed, cleared manually, resolved

NO.47 Which two types of information can FortiSIEM retrieve from FortiClient EMS through an external connection? (Choose two.)

Device login credentials

Vulnerability scan events

Devices with FortiSIEM agents

Zero trust network access (ZTNA) tags

NO.48 Refer to the exhibit.

An analyst is troubleshooting the rule shown in the exhibit. It is not generating any incidents, but the filter parameters are generating events on the Analytics tab.
What is wrong with the rule conditions?

The Event Type refers to a CMDB lookup and should be an Event lookup.

The Destination Host Name value is not fully qualified.

The Group By attributes restricts which events are counted.

The Aggregate attribute is too restrictive.

NO.49 Refer to the exhibit.

An analyst wants the rule shown in the exhibit to trigger when three failed login attempts occur within three minutes.
What should the values be for the condition time window and aggregate count?

Time window 180 seconds, aggregate count 3

Time window 180 seconds, aggregate count 2

Time window 90 seconds, aggregate count 3

Time window 90 seconds, aggregate count 2

NO.50 Refer to the exhibit.

An analyst is trying to identify an issue using an expression based on the Expression Builder settings shown in the exhibit; however, the error message shown in the exhibit indicates that the expression is invalid.
What is the correct syntax to create an expression that generates a total count of matched events?

COUNT(Matched Events)

(COUNT) Matched Events

Matched Events (COUNT)

Matched Events COUNT()

NO.51 A rule that detects network connections to an SSH server is triggering constantly in response to background internet traffic and must be tuned. Which method is used to tune this rule and solve the issue?

Update the Group By attribute to include only allowed host IP addresses.

Increase the COUNT (Matched Events)value in the subpattern.

Block connections from unauthorized networks before they reach the server.

Increase the time window on the FortiSIEM rule.

NO.52 You want to reference the first source IP address from an incident in a playbook. Which option shows the correct Jinja syntax for using a variable for the source IP address in a FortiSIEM playbook?

vars.input.records[0].srcIpAddr

srcIpAddr(1)

srcIpAddr.records[0]

record(srcIpAddr)

NO.53 Refer to the exhibit.

A FortiSIEM device is receiving syslog events from a FortiGate firewall. The FortiSIEM analyst is trying to search the raw event logs for the last two hours that contain the keyword ” udp ” . However, they are getting no results from the search, which they know should be available. Based on the filter shown in the exhibit, why are there no search results?

The analyst selected AND in the Next column. This is the wrong Boolean operator.

The Time Range value should be set to Real-Time.

The keyword is case sensitive. Instead of typing udp in the Value field, the analyst should type UDP.

The analyst selected = in the Operator column. That is the wrong operator.

NO.54 Which items are used to define a subpattern?

Filters, Aggregate, Group By definitions

Filters, Aggregate, Time Window definitions

Filters, Group By, Threshold definitions

Filters, Threshold, Time Window definitions

NO.55 Refer to the exhibit. Which two lookup types can you reference as the subquery in a nested analytics query? (Choose two.)

CMDB query

LDAP query

Event query

API query

NO.56 Refer to the exhibit.

FortiSIEM is receiving syslog events from a firewall.
You are trying to search raw event logs for traffic from the last two hours that contain the keyword
“UDP”. However, you are getting no results from the search.
Based on the filter shown in the exhibit, why are you getting no search results?