Use NSE5_FSM-5.2 Exam Dumps (2022 PDF Dumps) To Have Reliable NSE5_FSM-5.2 Test Engine [Q23-Q45]

NEW QUESTION 23
Which FortiSIEM components are capable of performing device discovery?

FortiSIEM Windows agent

Worker

FortiSIEM Linux agent

Collector

NEW QUESTION 24
An administrator defines SMTP as a critical process on a Linux server. If the SMTP process is stopped, FortiSIEM would generate a critical event with which event type?

PH_DEV_MON_PROC_STOP

Postfix-Mail-Slop

Generic_SMTP_Process_Exit

PH_DEV_MON_SMTP_STOP

NEW QUESTION 25
If an incident’s status is Cleared, what does this mean?

Two hours have passed since the incident occurred and the incident has not reoccurred.

A clear condition set on a rule was satisfied.

A security rule issue has been resolved.

The incident was cleared by an operator.

NEW QUESTION 26
An administrator wants to search for events received from Linux and Windows agents.
Which attribute should the administrator use in search filters, to view events received from agents only.

External Event Receive Protocol

Event Received Proto Agents

External Event Receive Raw Logs

External Event Receive Agents

NEW QUESTION 27
Refer to the exhibit.

A FortiSIEM administrator wants to collect both SIEM event logs and performance and availability metrics (PAM) events from a Microsoft Windows server Which protocol should the administrator select in the Access Protocol drop-down list so that FortiSIEM will collect both SIEM and PAM events?

TELNET

WMI

LDAPS

LDAP start TLS

NEW QUESTION 28
Refer to the exhibit.

A FortiSIEM is continuously receiving syslog events from a FortiGate firewall The FortiSlfcM administrator is trying to search the raw event logs for the last two hours that contain the keyword tcp . However, the administrator is getting no results from the search.
Based on the selected filters shown in the exhibit, why are there no search results?

The keyword is case sensitive Instead of typing TCP in the Value field. the administrator should type tcp.

In the Time section, the administrator selected the Relative Last option, and in the drop-down lists, selected 2 and Hours as the lime period The time period should be 24 hours.

The administrator selected – in the Operator column That a the wrong operator.

The administrator selected AND in the Next drop-down list. This is the wrong boolean operator.

NEW QUESTION 29
Which protocol is almost always required for the FortiSIEM GUI discovery process?

SNMP

WMI

Syslog

Telnet

NEW QUESTION 30
Which item is required to register a FortiSIEM appliance license?

Static storage

Static MAC address

Static IP address

Static Hardware ID

NEW QUESTION 31
What is a prerequisite for FortiSIEM Linux agent installation?

The web server must be installed on the Linux server being monitored

The auditd service must be installed on the Linux server being monitored

The Linux agent manager server must be installed.

Both the web server and the audit service must be installed on the Linux server being monitored

NEW QUESTION 32
What are the minimum memory requirements for the FortiSIEM supervisor virtual appliance, when the proprietary flat file database is used?

16GB RAM

32GB RAM

64GB RAM

24GB RAM

NEW QUESTION 33
Refer to the exhibit.

If events are grouped by Reporting IP, Event Type, and user attributes in FortiSIEM, how ,many results will be displayed?

Seven results will be displayed.

There results will be displayed.

Unique attribute cannot be grouped.

Five results will be displayed.

NEW QUESTION 34
Refer to the exhibit.

An administrator is trying to identify an issue using an expression bated on the Expression Builder settings shown in the exhibit however, the error message shown in the exhibit indicates that the expression is invalid.
Which is the correct expression?

Matched Events COUNT()

Matched Events(COUNT)

COUNT(Matched Events)

(COUNT) Matched Events

NEW QUESTION 35
What are the four possible incident status values?

Active, dosed, cleared, open

Active, cleared, cleared manually, system cleared

Active, closed, manual, resolved

Active, auto cleared, manual, false positive

NEW QUESTION 36
In the advanced analytical rules engine in FortiSIEM, multiple subpatterms can be referenced using which three operation?(Choose three.)

ELSE

NOT

FOLLOWED_BY

AND

NEW QUESTION 37
Which process converts Raw log data to structured data?

Data enrichment

Data classification

Data parsing

Data validation

NEW QUESTION 38
If an incident’s status is Cleared, what does this mean?

Two hours have passed since the incident occurred and the incident has not reoccurred.

A clear condition set on a rule was satisfied.

A security rule issue has been resolved.

The incident was cleared by an operator.

NEW QUESTION 39
What protocol can be used to collect Windows event logs in an agentless method?

SSH

SNMP

WMI

SMTP

NEW QUESTION 40
Refer to the exhibit.

Three events are collected over a 10-minutc time period from two servers Server A and Server B.
Based on the settings being used for the rule subpattern. how many incidents will the servers generate?

Server A will not generate any incidents and Server B will not generate any incidents

Server A will generate one incident and Server B wifl generate one incident

Server A will generate one incident and Server B will not generate any incidents

Server B will generate one incident and Server A will not generate any incidents

NEW QUESTION 41
Which process converts Raw log data to structured data?

Data enrichment

Data classification

Data parsing

Data validation

NEW QUESTION 42
What are the four categories of incidents?

Devices, users, high risk, and low risk

Performance, availability, security, and change

Performance, devices, high risk, and low risk

Security, change, high risk, and low risk

NEW QUESTION 43
Which three ports can be used to send Syslogs to FortiSIEM? (Choose three.)

UDP9999

UDP 162

TCP 514

UDP 514

TCP 1470

NEW QUESTION 44
Refer to the exhibit.

If events are grouped by Reporting IP, Event Type, and user attributes in FortiSIEM, how ,many results will be displayed?