If you are responsible for day-to-day management of FortiSIEM, then you can take NSE5_FSM-5.2 Fortinet NSE 5 - FortiSIEM 5.2 exam to get certified. Passcert new released Fortinet NSE 5 - FortiSIEM 5.2 NSE5_FSM-5.2 Dumps which are designed to cover the knowledge points of Fortinet NSE 5 - FortiSIEM 5.2 exam to help you pass your Fortinet NSE5_FSM-5.2 exam easily.After using Fortinet NSE 5 - FortiSIEM 5.2 NSE5_FSM-5.2 Dumps created by Passcert team, you will be able to clear Fortinet NSE 5 - FortiSIEM 5.2 exam on your first attempt.

Fortinet NSE 5 - FortiSIEM 5.2

Exam series: NSE5_FSM-5.2

Number of questions: 30

Exam time: 60 minutes

Language: English

Product version: FortiSIEM 5.2

Status: Available

Identify business drivers for using SIEM tools

Describe SIEM and PAM concepts

Describe key features of FortiSIEM

Understand how collectors, workers, and supervisors work together

Configure notifications

Create new users and custom roles

Describe the discovery process

Enable devices for discovery

Understand when to use agents

Perform real-time, historic structured searches

Group and aggregate search results

Examine performance metrics

Create custom incident rules

Edit existing, or create new, reports

Configure and customize the dashboards

Export CMDB information

Identify Windows Agent components

Describe what Windows Agents are used for

Understand how the Windows Agent Manager works in various deployment models

Identify reports that relate to Windows Agents

Understand FortiSIEM Linux File Monitoring Agent

Understand agent registration

Monitor agent communications after deployment

What are the four categories of incidents?

A.Devices, users, high risk, and low risk

B.Performance, availability, security, and change

C.Performance, devices, high risk, and low risk

D.Security, change, high risk, and low risk

Answer : B

In FotiSlEM enterprise licensing mode, if the link between the collector and data center FortiSlEM cluster a down what happens?

A.The collector drops incoming events like syslog. but slops performance collection

B.The collector continues performance collection of devices, but stops receiving syslog

C.The collector buffers events

D.The collector processes stop, and events are dropped

Answer : D

Which database is used for storing anomaly data, that is calculated for different parameters, such as traffic and device resource usage running averages, and standard deviation values?

A.Profile DB

B.Event DB

C.CMDB

D.SVN DB

Answer : B

Which process converts Raw log data to structured data?

A.Data enrichment

B.Data classification

C.Data parsing

D.Data validation

Answer : D

Refer to the exhibit.

If events are grouped by Event Receive Time, Reporting IP, and User attributes in FortiSIEM, how many results will be displayed?

A.Eight results will be displayed

B.Four results will be displayed

C.Two results will be displayed

D.Unique attributes cannot be grouped

Answer : D