Fortinet Exam NSE5_FSM-6.3 Topic 3 Question 25 Discussion

Actual exam question for Fortinet's NSE5_FSM-6.3 exam

Question #: 25
Topic #: 3

[All NSE5_FSM-6.3 Questions]

If a performance rule is triggered repeatedly due to high CPU use, what occurs in the incident table?

AA now incident is created each time the rule is triggered. and the First Seen and Last Seen times are updated.

BA new incident is created based on the Rule Frequency value, and the First Seen and Last Seen times ate updated.

CThe Incident Count value increases, and the First Seen and Last Seen times update.

DThe incident status changes to Repeated, and the First Seen and Last Seen times are updated.

Show Suggested Answer

Suggested Answer: C

Incident Management in FortiSIEM: FortiSIEM tracks incidents and their occurrences to help administrators manage and respond to recurring issues.

Performance Rule Triggering: When a performance rule, such as one for high CPU usage, is repeatedly triggered, FortiSIEM updates the corresponding incident rather than creating a new one each time.

Incident Table Updates:

Incident Count: The Incident Count value increases each time the rule is triggered, indicating how many times the incident has occurred.

First Seen and Last Seen Times: These timestamps are updated to reflect the first occurrence and the most recent occurrence of the incident.

Reference: FortiSIEM 6.3 User Guide, Incident Management section, explains how FortiSIEM handles recurring incidents and updates the incident table accordingly.

by Nancey at May 03, 2025, 04:14 AM

Limited Time Offer

25%

Off

Get Premium NSE5_FSM-6.3 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Tamekia

2 months ago

I think the answer is B. A new incident is created based on the Rule Frequency value.

upvoted 0 times

...

Virgie

3 months ago

Did anyone else notice how they're trying to trick us with those last seen and first seen times? Clearly, option C is the way to go. Simple and straightforward.

upvoted 0 times

...

Alaine

3 months ago

Guys, I think we're all overthinking this. The answer is clearly C. The incident count increasing is the most straightforward way to handle repeated rule triggers.

upvoted 0 times

Sharee

2 months ago

But wouldn't A also make sense since a new incident is created each time the rule is triggered?

upvoted 0 times

...

Latia

2 months ago

I agree, C seems like the most logical choice here.

upvoted 0 times

...

3 months ago

Hmm, I'm not too sure about this one. But I'm leaning towards option D. Seems logical that the incident status would change to Repeated if the rule is triggered repeatedly.

upvoted 0 times

Clorinda

1 months ago

Option B does sound plausible. The First Seen and Last Seen times are updated too.

upvoted 0 times

...

Walton

2 months ago

I'm not sure, but I think option B is the correct answer. A new incident is created based on the Rule Frequency value.

upvoted 0 times

...

Zona

2 months ago

I agree, option A makes sense. The First Seen and Last Seen times are updated as well.

upvoted 0 times

...

Portia

2 months ago

I think option A is correct. A new incident is created each time the rule is triggered.

upvoted 0 times

...

4 months ago

I think the answer is A. A new incident is created each time the rule is triggered.

upvoted 0 times

...