PDF Version DemoFortinet NSE5_FSM-5.2 Exam Overview:
| Certification Vendor: | Fortinet |
| Exam Name: | NSE 5 - FortiSIEM 5.2 |
| Exam Number: | NSE5_FSM-5.2 |
| Exam Price: | $200 USD |
| Exam Format: | Multiple Choice, Multiple Select |
| Real Exam Qty: | 30-33 |
| Exam Duration: | 60 minutes |
| Certificate Validity Period: | 2 years |
| Related Certifications: | NSE 4 Network Security Professional NSE 5 Security Operations |
| Passing Score: | Pass/Fail |
| Available Languages: | English |
| Recommended Training: | FortiSIEM 5.2 Administrator Training |
| Exam Registration: | Fortinet Training Institute Pearson VUE Registration |
| Sample Questions: | Fortinet NSE5_FSM-5.2 Sample Questions |
| Exam Way: | Online proctored (OnVUE) or in-person at Pearson VUE test centers |
| Pre Condition: | NSE 4 certification recommended; no mandatory prerequisites |
| Official Syllabus URL: | https://training.fortinet.com/ |
Fortinet NSE5_FSM-5.2 Exam Syllabus Topics:
| Section | Weight | Objectives |
|---|---|---|
| Monitoring and Operations | 25% | - Performance tuning and maintenance - Device discovery and inventory - Event searching and querying |
| Rules, Incidents and Reporting | 25% | - Report generation and compliance - Incident management and workflow - Rule creation and configuration |
| FortiSIEM Architecture and Concepts | 25% | - Deployment models and requirements - System components and architecture - SIEM fundamentals and event classification |
| Installation and Configuration | 25% | - Initial setup and system configuration - Data collection and log ingestion - Agent deployment and management |
Fortinet NSE 5 - FortiSIEM 5.2 Sample Questions:
1. Refer to the exhibit.
A FortiSIEM is continuously receiving syslog events from a FortiGate firewall The FortiSlfcM administrator is trying to search the raw event logs for the last two hours that contain the keyword tcp . However, the administrator is getting no results from the search.
Based on the selected filters shown in the exhibit, why are there no search results?
A) The keyword is case sensitive Instead of typing TCP in the Value field. the administrator should type tcp.
B) The administrator selected AND in the Next drop-down list. This is the wrong boolean operator.
C) The administrator selected - in the Operator column That a the wrong operator.
D) In the Time section, the administrator selected the Relative Last option, and in the drop-down lists, selected 2 and Hours as the lime period The time period should be 24 hours.
2. What protocol can be used to collect Windows event logs in an agentless method?
A) SSH
B) SMTP
C) WMI
D) SNMP
3. If a performance rule is triggered repeatedly due to high CPU use. what occurs m the incident table?
A) A new incident is created each time the rule is triggered, and the First Seen and Last Seen times are updated.
B) A new incident is created based on the Rule Frequency value, and the First Seen and Last Seen times are updated
C) The Incident Count value increases, and the First Seen and Last Seen tomes update
D) The incident status changes to Repeated and the First Seen and Last Seen times are updated.
4. An administrator defines SMTP as a critical process on a Linux server. If the SMTP process is stopped, FortiSIEM would generate a critical event with which event type?
A) PH_DEV_MON_SMTP_STOP
B) Generic_SMTP_Process_Exit
C) PH_DEV_MON_PROC_STOP
D) Postfix-Mail-Slop
5. Refer to the exhibit.
How was the FortiGate device discovered by FortiSIEM?
A) Through auto log discovery
B) Through syslog discovery
C) Through GUI log discovery
D) Using the pull events method
Solutions:
| Question # 1 Answer: C | Question # 2 Answer: C | Question # 3 Answer: A | Question # 4 Answer: C | Question # 5 Answer: C |
We are confident about the products and aim to help you pass with ease. In case of failure, we will provide a no hassle full money back guarantee for the purchasing fee.
980 Customer Reviews
Quality and ValueITbraindumps Practice Exams are written to the highest standards of technical accuracy, using only certified subject matter experts and published authors for development - no all study materials.
Tested and ApprovedWe are committed to the process of vendor and third party approvals. We believe professionals and executives alike deserve the confidence of quality coverage these authorizations provide.
Easy to PassIf you prepare for the exams using our ITbraindumps testing engine, It is easy to succeed for all certifications in the first attempt. You don't have to deal with all dumps or any free torrent / rapidshare all stuff.
Try Before BuyITbraindumps offers free demo of each product. You can check out the interface, question quality and usability of our practice exams before you decide to buy.