Fortinet NSE6_FSM_AN-7.4 Dumps Questions Answers

The correct answer is A because CMDB objects are referenced from the Value field after selecting the appropriate event attribute and operator. The FortiSIEM Study Guide gives a structured search example that references the CMDB. In that example, the attribute is Reporting IP, the operator is IN, and the value is selected from CMDB groups such as Devices: Windows and Networks: Inside Net. The guide explains that to show events reported by Windows servers within a specific network, you set the attribute and operator first, then browse the CMDB and select the relevant CMDB group value. This confirms the workflow: the CMDB reference is chosen as the value of the condition, not as the attribute itself. Option B is incorrect because the CMDB tab is not used to launch the analytics search this way. Option C is not a valid workflow. Option D is wrong because the attribute is selected from event or CMDB attribute lists, while the CMDB object or group is selected in the value field.

FortiSIEM applies tags to FortiClient EMS-managed hosts through FortiEMS integration. The FortiSIEM 7.4 User Guide states that FortiSIEM supports discovery of FortiEMS servers using the FortiEMS Management Server API with username/password authentication. That supports option A: FortiEMS API credentials must be configured on FortiSIEM. The same guide explains that after FortiEMS discovery, “FortiSIEM can tag or untag a host, using classification tags on FortiEMS server.” It further explains the ZTNA workflow: in ZTNA, these tags are imported by Fortinet devices, especially FortiGate firewalls, and referenced in ZTNA firewall rules. That supports option C: the tag value used for ZTNA classification must be available/defined for the FortiEMS tagging workflow. Option B is not the best required configuration in the question because a remediation script is an execution method, not one of the two foundational settings being asked for. Option D reverses the API relationship; FortiSIEM connects to FortiEMS using FortiEMS credentials, not FortiSIEM API credentials stored on EMS.

The correct answers are A. Email and B. FortiSIEM Case. FortiSIEM automation policies can notify or route work to analysts when an incident is triggered. The Study Guide describes the incident notification email workflow and explains that when an incident triggers and an automation policy is defined, FortiSIEM can send a notification email using the default template. It also explains that notification frequency is configured per rule and that repeated incident notifications are controlled by the frequency timer. The FortiSIEM 7.4 User Guide also describes automated case creation through automation policy. It states that an automation policy can use the action Create Case when an incident is created, and that a case management policy can assign FortiSIEM Analyst Teams in an ordered handling sequence. Syslog is not listed as one of the analyst notification methods in the automation policy options shown in this question; FortiSIEM supports SNMP and webhook-style actions, but not “Syslog” as the listed answer. A pop-up window is not an automation policy notification method. Therefore, the two correct analyst-notification/routing methods are Email and FortiSIEM Case.