[Aug 13, 2023] Get to the Top with NSE5_FSM-5.2 Practice Exam Questions [Q25-Q42]

Rate this post

[Aug 13, 2023] Get to the Top with NSE5_FSM-5.2 Practice Exam Questions

Use Real NSE5_FSM-5.2 Dumps Free Sample Questions and Practice Test Engine

Fortinet is a well-known global leader in providing cybersecurity solutions. The company offers a wide range of network security products and services that help businesses and organizations protect their critical data and resources from cyber threats. The Fortinet NSE5_FSM-5.2 exam is one of the professional certification exams offered by Fortinet that focuses on FortiSIEM 5.2, a comprehensive security information and event management (SIEM) solution.

Fortinet NSE5_FSM-5.2 exam is designed to test the knowledge and skills of individuals who are interested in securing and managing enterprise network infrastructures. It is part of the Fortinet Network Security Expert (NSE) program, which is a certification program that offers a comprehensive and practical approach to network security education. The NSE program is designed to help individuals become experts in network security and to prepare them for real-world situations.

NO.25 What are the four categories of incidents?

Devices, users, high risk, and low risk

Performance, availability, security, and change

Performance, devices, high risk, and low risk

Security, change, high risk, and low risk

NO.26 Refer to the exhibit.

What do the yellow stars listed in the Monitor column indicate?

A yellow star indicates that a metric was applied during discovery, and data has been collected successfully

A yellow star indicates that a metric was applied during discovery, but data collection has not started

A yellow star indicates that a metric was applied during discovery, but FortiSIEM is unable to collect data.

A yellow star indicates that a metric was not applied during discovery and, therefore, FortiSEIM was unable to collect data.

NO.27 If a performance rule is triggered repeatedly due to high CPU use. what occurs m the incident table?

A new incident is created each time the rule is triggered, and the First Seen and Last Seen times are updated.

The incident status changes to Repeated and the First Seen and Last Seen times are updated.

A new incident is created based on the Rule Frequency value, and the First Seen and Last Seen times are updated

The Incident Count value increases, and the First Seen and Last Seen tomes update

NO.28 Refer to the exhibit.

Three events are collected over a 10-minutc time period from two servers Server A and Server B.
Based on the settings being used for the rule subpattern. how many incidents will the servers generate?

Server A will not generate any incidents and Server B will not generate any incidents

Server A will generate one incident and Server B wifl generate one incident

Server A will generate one incident and Server B will not generate any incidents

Server B will generate one incident and Server A will not generate any incidents

NO.29 Which three ports can be used to send Syslogs to FortiSIEM? (Choose three.)

UDP9999

UDP 162

TCP 514

UDP 514

TCP 1470

NO.30 Refer to the exhibit.

A FortiSIEM administrator wants to collect both SIEM event logs and performance and availability metrics (PAM) events from a Microsoft Windows server Which protocol should the administrator select in the Access Protocol drop-down list so that FortiSIEM will collect both SIEM and PAM events?

TELNET

WMI

LDAPS

LDAP start TLS

NO.31 Which command displays the Linux agent status?

Service Ao-linux-agent status

Service linux-agent status

Service fortisiem-linux-agent status

Service fsm-linux-agent status

NO.32 Refer to the exhibit.

A FortiSIEM administrator wants to collect both SIEM event logs and performance and availability metrics (PAM) events from a Microsoft Windows server Which protocol should the administrator select in the Access Protocol drop-down list so that FortiSIEM will collect both SIEM and PAM events?

TELNET

WMI

LDAPS

LDAP start TLS

NO.33 Which discovery scan type is prone to miss a device, if the device is quiet and the entry foe that device is not present in the ARP table of adjacent devices?

CMDB scan

L2 scan

Range scan

Smart scan

NO.34 Refer to the exhibit.

If events are grouped by Reporting IP, Event Type, and user attributes in FortiSIEM, how ,many results will be displayed?

Seven results will be displayed.

There results will be displayed.

Unique attribute cannot be grouped.

Five results will be displayed.

NO.35 Refer to the exhibit.

How was the FortiGate device discovered by FortiSIEM?

Through GUI log discovery

Through syslog discovery

Using the pull events method

Through auto log discovery

NO.36 What is a prerequisite for FortiSIEM Linux agent installation?

The web server must be installed on the Linux server being monitored

The auditd service must be installed on the Linux server being monitored

The Linux agent manager server must be installed.

Both the web server and the audit service must be installed on the Linux server being monitored

NO.37 Which three ports can be used to send Syslogs to FortiSIEM? (Choose three.)

UDP9999

UDP 162

TCP 514

UDP 514

TCP 1470

NO.38 Refer to the exhibit.

An administrator is trying to identify an issue using an expression bated on the Expression Builder settings shown in the exhibit however, the error message shown in the exhibit indicates that the expression is invalid.
Which is the correct expression?

Matched Events COUNT()

Matched Events(COUNT)

COUNT(Matched Events)

(COUNT) Matched Events

NO.39 Refer to the exhibit.

A FortiSlEM administrator wants to group some attributes for a report, but is not able to do so successfully.
As shown in the exhibit, why are some of the fields highlighted in red?

The Event Receive Time attribute is not available for logs.

The attribute COUNT(Matched event) is an invalid expression.

Unique attributes cannot be grouped.

No RAW Event Log attribute is available for devices.

NO.40 If an incident’s status is Cleared, what does this mean?

Two hours have passed since the incident occurred and the incident has not reoccurred.

A clear condition set on a rule was satisfied.

A security rule issue has been resolved.

The incident was cleared by an operator.

NO.41 Refer to the exhibit.

A FortiSIEM is continuously receiving syslog events from a FortiGate firewall The FortiSlfcM administrator is trying to search the raw event logs for the last two hours that contain the keyword tcp . However, the administrator is getting no results from the search.
Based on the selected filters shown in the exhibit, why are there no search results?

The keyword is case sensitive Instead of typing TCP in the Value field. the administrator should type tcp.

In the Time section, the administrator selected the Relative Last option, and in the drop-down lists, selected 2 and Hours as the lime period The time period should be 24 hours.

The administrator selected – in the Operator column That a the wrong operator.

The administrator selected AND in the Next drop-down list. This is the wrong boolean operator.

NO.42 What is the best discovery scan option for a network environment where ping is disabled on all network devices?

Smart scan

Range scan

CMDB scan

L2 scan

Loading …