NSE5_FSM-6.3 Fortinet Exam Practice Questions
Uploaded by
certquestionsbankNSE5_FSM-6.3 Fortinet Exam Practice Questions
Uploaded by
certquestionsbankThis PDF contains a set of carefully selected practice questions for the
NSE5_FSM-6.3 exam. These questions are designed to reflect the
structure, difficulty, and topics covered in the actual exam, helping you
reinforce your understanding and identify areas for improvement.
What's Inside:
1. Topic-focused questions based on the latest exam objectives
2. Accurate answer keys to support self-review
3. Designed to simulate the real test environment
4. Ideal for final review or daily practice
Important Note:
This material is for personal study purposes only. Please do not
redistribute or use for commercial purposes without permission.
For full access to the complete question bank and topic-wise explanations, visit:
CertQuestionsBank.com
Our YouTube: https://www.youtube.com/@CertQuestionsBank
FB page: https://www.facebook.com/certquestionsbank
Share some NSE5_FSM-6.3 exam online questions below.
1.Which discovery scan type is prone to miss a device, if the device is quiet and the entry foe that
device is not present in the ARP table of adjacent devices?
A. CMDB scan
B. L2 scan
C. Range scan
D. Smart scan
Answer: B
Explanation:
Discovery Scan Types: FortiSIEM uses various scan types to discover devices on a network.
Layer 2 (L2) Scan: An L2 scan discovers devices based on ARP tables and MAC address information
from adjacent devices.
Limitation: If a device is quiet (not actively communicating) and its entry is not present in the ARP
table of adjacent devices, the L2 scan may miss it.
Other Scan Types:
CMDB Scan: Based on the existing Configuration Management Database (CMDB) entries.
Range Scan: Scans a specified IP range for devices.
Smart Scan: Uses a combination of methods to discover devices.
Reference: FortiSIEM 6.3 User Guide, Device Discovery section, which explains the different types of
discovery scans and their characteristics.
2.Which two FortiSIEM components work together to provide real-time event correlation?
A. Supervisor and worker
B. Collector and Windows agent
C. Worker and collector
D. Supervisor and collector
Answer: C
Explanation:
FortiSIEM Architecture: The FortiSIEM architecture includes several components such as
Supervisors, Workers, Collectors, and Agents, each playing a distinct role in the SIEM ecosystem.
Real-Time Event Correlation: Real-time event correlation is a critical function that involves analyzing
and correlating incoming events to detect patterns indicative of security incidents or operational
issues.
Role of Supervisor and Worker:
Supervisor: The Supervisor oversees the entire FortiSIEM system, coordinating the processing and
analysis of events.
Worker: Workers are responsible for processing and correlating the events received from Collectors
and Agents.
Collaboration for Correlation: Together, the Supervisor and Worker components perform real-time
event correlation by distributing the load and ensuring efficient processing of events to identify
incidents in real-time.
Reference: FortiSIEM 6.3 User Guide, Event Correlation and Processing section, details how the
Supervisor and Worker components collaborate for real-time event correlation.
3.10.10.10, Failed Logon, Ryan, 1.1.1.1, Web App (duplicate, counted as one unique result)
4.10.10.11, Failed Logon, Ryan, 1.1.1.15, DB
5.Refer to the exhibit.
If events are grouped by Reporting IP, Event Type, and user attributes in FortiSIEM, how, many
results will be displayed?
A. Seven results will be displayed.
B. There results will be displayed.
C. Unique attribute cannot be grouped.
D. Five results will be displayed.
Answer: A
Explanation:
Grouping Events: Grouping events by specific attributes allows for the aggregation of similar events.
Grouping Criteria: For this question, events are grouped by "Reporting IP," "Event Type," and "User."
Unique Combinations Analysis:
6.FortiSIEM is deployed in disaster recovery mode.
When disaster strikes, which two tasks must you perform manually to achieve a successful disaster
recovery operation? (Choose two.)
A. Promote the secondary workers to the primary rotes using the phSecworker2priworker command.
B. Promote the secondary supervisor to the primary role using the phSecondary2primary command.
C. Change the DNS configuration to ensure that users, devices, and collectors log in to the secondary
FortiSIEM.
D. Change the configuration for shared storage NFS configured for EventDB to the secondary
FortiSIEM.
Answer: A, C
Explanation:
Disaster Recovery Mode: FortiSIEM's disaster recovery (DR) mode ensures that there is a backup
system ready to take over in case the primary system fails.
Manual Tasks for DR Operation: In the event of a disaster, certain tasks must be performed manually
to ensure a smooth transition to the secondary system.
Promoting the Secondary Supervisor:
Use the command phSecondary2primary to promote the secondary supervisor to the primary role.
This command reconfigures the secondary supervisor to take over as the primary supervisor,
ensuring continuity in management and coordination. Changing DNS Configuration:
Update the DNS configuration to direct all users, devices, and collectors to the secondary FortiSIEM
instance. This ensures that all components in the environment can communicate with the newly
promoted primary supervisor without manual reconfiguration of individual devices.
Reference: FortiSIEM 6.3 Administration Guide, Disaster Recovery section, provides detailed steps
on promoting the secondary supervisor and updating DNS configurations during a disaster recovery
operation.
7.10.10.10, Failed Logon, Paul, 3.3.2.1, Web App
8.Device discovery information is stored in which database?
A. CMDB
B. Profile DB
C. Event DB
D. SVN DB
Answer: A
Explanation:
Device Discovery Information: Information about discovered devices, including their configurations
and statuses, is stored in a specific database.
CMDB: The Configuration Management Database (CMDB) is used to store detailed information about
the devices discovered by FortiSIEM.
Function: It maintains comprehensive details about device configurations, relationships, and other
metadata essential for managing the IT infrastructure.
Significance: Storing discovery information in the CMDB ensures that the FortiSIEM system has a
centralized repository of device information, facilitating efficient management and monitoring.
Reference: FortiSIEM 6.3 User Guide, Configuration Management Database (CMDB) section, which
details the storage and usage of device discovery information.
9.Refer to the exhibit.
If events are grouped by User. Source IP. and Application Category attributes in FortiSiEM. how
many results will be displayed?
A. Three results will be displayed.
B. Five results will be displayed.
C. No results will be displayed.
D. Seven results will be displayed.
Answer: B
Explanation:
Grouping Events in FortiSIEM: Grouping events by specific attributes allows for the aggregation of
similar events, providing clearer insights and reducing clutter.
Grouping Criteria: For this question, events are grouped by "User," "Source IP," and "Application
Category."
Unique Combinations Analysis:
Ryan, 1.1.1.1, Web App (appears multiple times but is one unique combination)
John, 5.5.5.5, DB
Paul, 3.3.2.1, Web App
Ryan, 1.1.1.15, DB
Wendy, 1.1.1.6, DB
Result Calculation: There are five unique combinations in the provided data based on the specified
grouping attributes.
Reference: FortiSIEM 6.3 User Guide, Event Management and Reporting sections, which explain how
to group events by various attributes for analysis and reporting purposes.