[Sep 15, 2023] Real4exams NSE5_FSM-5.2 Exam Practice Test Questions (Updated 43 Questions) [Q11-Q35]

Q11. If the reported packet loss is between 50% and 98%. which status is assigned to the device in the Availability column of summary dashboard?

Q12. Refer to the exhibit.

If events are grouped by Event Receive Time, Reporting IP, and User attributes in FortiSIEM, how many results will be displayed?

Q13. Which three ports can be used to send Syslogs to FortiSIEM? (Choose three.)

Q14. Refer to the exhibit.

A FortiSIEM administrator wants to collect both SIEM event logs and performance and availability metrics (PAM) events from a Microsoft Windows server Which protocol should the administrator select in the Access Protocol drop-down list so that FortiSIEM will collect both SIEM and PAM events?

Q15. A FortiSIEM supervisor at headquarters is struggling to keep up with an increase of EPS (Events Per Second) being reported across the enterprise. What components should an administrator consider deploying to assist the supervisor with processing data?

Q16. Which process converts Raw log data to structured data?

Q17. What are the minimum memory requirements for the FortiSIEM supervisor virtual appliance, when the proprietary flat file database is used?

Q18. In the advanced analytical rules engine in FortiSIEM, multiple subpatterms can be referenced using which three operation?(Choose three.)

Q19. Which two FortiSIEM components work together to provide real-time event correlation?

Q20. Refer to the exhibit.

How was the FortiGate device discovered by FortiSIEM?

Q21. What is the best discovery scan option for a network environment where ping is disabled on all network devices?

Q22. Refer to the exhibit.

A FortiSIEM administrator wants to collect both SIEM event logs and performance and availability metrics (PAM) events from a Microsoft Windows server Which protocol should the administrator select in the Access Protocol drop-down list so that FortiSIEM will collect both SIEM and PAM events?

Q23. What protocol can be used to collect Windows event logs in an agentless method?

Q24. What operating system is FortiSIEM based on?

Q25. To determine whether or not syslog is being received from a network device, which is the best command from the backend?

Q26. Refer to the exhibit.

If events are grouped by Event Receive Time, Reporting IP, and User attributes in FortiSIEM, how many results will be displayed?

Q27. An administrator defines SMTP as a critical process on a Linux server. If the SMTP process is stopped, FortiSIEM would generate a critical event with which event type?

Q28. If an incident’s status is Cleared, what does this mean?

Q29. Which discovery scan type is prone to miss a device, if the device is quiet and the entry foe that device is not present in the ARP table of adjacent devices?

Q30. Which FortiSIEM components can do performance availability and performance monitoring?

Q31. If an incident’s status is Cleared, what does this mean?

Q32. To determine SNMP discovery issues, which is the best command from the backend?

Q33. Refer to the exhibit.

A FortiSlEM administrator wants to group some attributes for a report, but is not able to do so successfully.
As shown in the exhibit, why are some of the fields highlighted in red?

Q34. Refer to the exhibit.

An administrator is trying to identify an issue using an expression bated on the Expression Builder settings shown in the exhibit however, the error message shown in the exhibit indicates that the expression is invalid.
Which is the correct expression?