Free Fortinet NSE 5 – FortiSIEM 5.2 Exam NSE5_FSM-5.2 Exam Practice Test

A FortiSIEM administrator wants to restrict a network administrator to running searches for only firewall devices. Under role management, which option does the FortiSIEM administrator need to configure to achieve this scenario?

• CMDBReportConditions
  
• DataConditions
  
• UI Access
  

Which three ports can be used to send Syslogs to FortiSIEM? (Choose three.)

• UDP9999
  
• UDP 162
  
• TCP 514
  
• UDP 514
  
• TCP 1470
  

Which item is required to register a FortiSIEM appliance license?

• Staticstorage
  
• StaticMACaddress
  
• StaticIPaddress
  
• Static Hardware ID
  

If a performance rule is triggered repeatedly due to high CPU use. what occurs m the incident table?

• A new incident is created each time the rule is triggered, and the First Seen and Last Seen times are updated.
  
• The incident status changes to Repeated and the First Seen and Last Seen times are updated.
  
• A new incident is created based on the Rule Frequency value, and the First Seen and Last Seen times are updated
  
• The Incident Count value increases, and the First Seen and Last Seen tomes update
  

What are the four categories of incidents?

• Devices, users, high risk, and low risk
  
• Performance, availability, security, and change
  
• Performance, devices, high risk, and low risk
  
• Security, change, high risk, and low risk
  

Which discovery scan type is prone to miss a device, if the device is quiet and the entry foe that device is not present in the ARP table of adjacent devices?

• CMDB scan
  
• L2 scan
  
• Range scan
  
• Smart scan
  

Which protocol is almost always required for the FortiSIEM GUI discovery process?

• SNMP
  
• WMI
  
• Syslog
  
• Telnet
  

In FotiSlEM enterprise licensing mode, if the link between the collector and data center FortiSlEM cluster a down what happens?

• The collector drops incoming events like syslog. but slops performance collection
  
• The collector continues performance collection of devices, but stops receiving syslog
  
• The collector buffers events
  
• The collector processes stop, and events are dropped
  

Device discovery information is stored in which database?

• CMDB
  
• Profile DB
  
• Event DB
  
• SVN DB
  

What protocol can be used to collect Windows event logs in an agentless method?

• SSH
  
• SNMP
  
• WMI
  
• SMTP