Fortinet NSE5_FSM-5.2 Exam Questions Instant Access

Question 1

If the reported packet loss is between 50% and 98%. which status is assigned to the device in the Availability column of summary dashboard?

ADown status is assigned because of packet loss.

BUp status is assigned because of received packets

CCritical status is assigned because of reduction in number of packets received

DDegraded status is assigned because of packet loss

Answer : D

Question 2

Which three ports can be used to send Syslogs to FortiSIEM? (Choose three.)

AUDP9999

BUDP 162

CTCP 514

DUDP 514

ETCP 1470

Answer : C, D, E

Question 3

Which two FortiSIEM components work together to provide real-time event correlation?

ACollector and Windows agent

BSupervisor and worker

CWorker and collector

DSupervisor and collector

Answer : D

Question 4

If an incident's status is Cleared, what does this mean?

ATwo hours have passed since the incident occurred and the incident has not reoccurred.

BA clear condition set on a rule was satisfied.

CA security rule issue has been resolved.

DThe incident was cleared by an operator.

Answer : B

Question 5

Refer to the exhibit.

If events are grouped by Reporting IP, Event Type, and user attributes in FortiSIEM, how ,many results will be displayed?

ASeven results will be displayed.

BThere results will be displayed.

CUnique attribute cannot be grouped.

DFive results will be displayed.

Answer : D

Question 6

Refer to the exhibit.

A FortiSIEM is continuously receiving syslog events from a FortiGate firewall The FortiSlfcM administrator is trying to search the raw event logs for the last two hours that contain the keyword tcp . However, the administrator is getting no results from the search.

Based on the selected filters shown in the exhibit, why are there no search results?

AThe keyword is case sensitive Instead of typing TCP in the Value field. the administrator should type tcp.

BIn the Time section, the administrator selected the Relative Last option, and in the drop-down lists, selected 2 and Hours as the lime period The time period should be 24 hours.

CThe administrator selected - in the Operator column That a the wrong operator.

DThe administrator selected AND in the Next drop-down list. This is the wrong boolean operator.

Answer : C

Question 7

Refer to the exhibit.

An administrator is trying to identify an issue using an expression bated on the Expression Builder settings shown in the exhibit however, the error message shown in the exhibit indicates that the expression is invalid.

Which is the correct expression?

AMatched Events COUNT()

BMatched Events(COUNT)

CCOUNT(Matched Events)

D(COUNT) Matched Events

Answer : C

Fortinet NSE 5 - FortiSIEM 5.2 NSE5_FSM-5.2 Exam Questions