Fortinet Exam NSE5_FSM-6.3 Topic 2 Question 19 Discussion

Actual exam question for Fortinet's NSE5_FSM-6.3 exam

Question #: 19
Topic #: 2

Refer to the exhibit.

A FortiSIEM is continuously receiving syslog events from a FortiGate firewall The FortiSlfcM administrator is trying to search the raw event logs for the last two hours that contain the keyword tcp . However, the administrator is getting no results from the search.

Based on the selected filters shown in the exhibit, why are there no search results?

AThe keyword is case sensitive Instead of typing TCP in the Value field. the administrator should type tcp.

BIn the Time section, the administrator selected the Relative Last option, and in the drop-down lists, selected 2 and Hours as the lime period The time period should be 24 hours.

CThe administrator selected - in the Operator column That a the wrong operator.

DThe administrator selected AND in the Next drop-down list. This is the wrong boolean operator.

Show Suggested Answer

Suggested Answer: D

Search Filters in FortiSIEM: When searching for specific events, administrators can use various attributes to filter the results.

Attribute for Agent Events: To view events received specifically from Linux and Windows agents, the attribute External Event Receive Agents should be used.

Function: This attribute filters events that are received from agents, distinguishing them from events received through other protocols or sources.

Search Efficiency: Using this attribute helps the administrator focus on events collected by FortiSIEM agents, making the search results more relevant and targeted.

Reference: FortiSIEM 6.3 User Guide, Event Search and Filters section, which describes the available attributes and their usage for filtering search results.

by Thomasena at Jan 14, 2025, 03:47 AM

Limited Time Offer

25%

Off

Get Premium NSE5_FSM-6.3 Questions as Interactive Web-Based Practice Test or PDF