NSE5_FSM-5.2 Practice Exam Tests Latest Updated on Aug-2021
Pass NSE5_FSM-5.2 Exam in First Attempt Guaranteed Dumps!
NEW QUESTION 12
What is the best discovery scan option for a network environment where ping is disabled on all network devices?
- A. Smart scan
- B. Range scan
- C. L2 scan
- D. CMDB scan
Answer: A
NEW QUESTION 13
A FortiSIEM supervisor at headquarters is struggling to keep up with an increase of EPS (Events Per Second) being reported across the enterprise. What components should an administrator consider deploying to assist the supervisor with processing data?
- A. Supervisor
- B. Agent
- C. Worker
- D. Collector
Answer: C
NEW QUESTION 14
Refer to the exhibit.
If events are grouped by Event Receive Time, Reporting IP, and User attributes in FortiSIEM, how many results will be displayed?
- A. Two results will be displayed
- B. Unique attributes cannot be grouped
- C. Eight results will be displayed
- D. Four results will be displayed
Answer: B
NEW QUESTION 15
Which FortiSIEM components can do performance availability and performance monitoring?
- A. Supervisor and workers only
- B. Supervisor only
- C. Supervisor, worker, and collector
- D. Collectors only
Answer: C
NEW QUESTION 16
Which three ports can be used to send Syslogs to FortiSIEM? (Choose three.)
- A. UDP 162
- B. UDP 514
- C. TCP 1470
- D. TCP 514
- E. UDP9999
Answer: B,C,D
NEW QUESTION 17
Refer to the exhibit.
An administrator is trying to identify an issue using an expression bated on the Expression Builder settings shown in the exhibit however, the error message shown in the exhibit indicates that the expression is invalid.
Which is the correct expression?
- A. Matched Events(COUNT)
- B. Matched Events COUNT()
- C. (COUNT) Matched Events
- D. COUNT(Matched Events)
Answer: D
NEW QUESTION 18
In the rules engine, which condition instructs FortiSIEM to summarize and count the matching evaluated data?
- A. Time Window
- B. Aggregation
- C. Filters
- D. Group By
Answer: B
NEW QUESTION 19
An administrator wants to search for events received from Linux and Windows agents.
Which attribute should the administrator use in search filters, to view events received from agents only.
- A. External Event Receive Agents
- B. External Event Receive Raw Logs
- C. Event Received Proto Agents
- D. External Event Receive Protocol
Answer: B
NEW QUESTION 20
What are the four possible incident status values?
- A. Active, closed, manual, resolved
- B. Active, dosed, cleared, open
- C. Active, auto cleared, manual, false positive
- D. Active, cleared, cleared manually, system cleared
Answer: A
NEW QUESTION 21
What are the minimum memory requirements for the FortiSIEM supervisor virtual appliance, when the proprietary flat file database is used?
- A. 16GB RAM
- B. 24GB RAM
- C. 64GB RAM
- D. 32GB RAM
Answer: B
NEW QUESTION 22
If an incident's status is Cleared, what does this mean?
- A. A clear condition set on a rule was satisfied.
- B. Two hours have passed since the incident occurred and the incident has not reoccurred.
- C. A security rule issue has been resolved.
- D. The incident was cleared by an operator.
Answer: A
NEW QUESTION 23
Refer to the exhibit.
How was the FortiGate device discovered by FortiSIEM?
- A. Through syslog discovery
- B. Through GUI log discovery
- C. Through auto log discovery
- D. Using the pull events method
Answer: B
NEW QUESTION 24
What is a prerequisite for FortiSIEM Linux agent installation?
- A. Both the web server and the audit service must be installed on the Linux server being monitored
- B. The Linux agent manager server must be installed.
- C. The auditd service must be installed on the Linux server being monitored
- D. The web server must be installed on the Linux server being monitored
Answer: A
NEW QUESTION 25
An administrator defines SMTP as a critical process on a Linux server. If the SMTP process is stopped, FortiSIEM would generate a critical event with which event type?
- A. Postfix-Mail-Slop
- B. Generic_SMTP_Process_Exit
- C. PH_DEV_MON_PROC_STOP
- D. PH_DEV_MON_SMTP_STOP
Answer: C
NEW QUESTION 26
Which process converts Raw log data to structured data?
- A. Data enrichment
- B. Data parsing
- C. Data validation
- D. Data classification
Answer: C
NEW QUESTION 27
If the reported packet loss is between 50% and 98%. which status is assigned to the device in the Availability column of summary dashboard?
- A. Critical status is assigned because of reduction in number of packets received
- B. Down status is assigned because of packet loss.
- C. Degraded status is assigned because of packet loss
- D. Up status is assigned because of received packets
Answer: C
NEW QUESTION 28
What operating system is FortiSIEM based on?
- A. Microsoft Windows
- B. RedHat
- C. Cent OS
- D. Ubuntu
Answer: C
NEW QUESTION 29
......
NSE 5 Network Security Analyst Free Certification Exam Material from ValidBraindumps with 43 Questions: https://www.validbraindumps.com/NSE5_FSM-5.2-exam-prep.html
NSE5_FSM-5.2 Dumps Full Questions - Exam Study Guide: https://drive.google.com/open?id=15tszyOFyJryM475RCwjBJnRWNHOlbwSc