Fortinet NSE5_FSM-6.3 Practice Exams
Last updated on Oct 22,2026- Exam Code: NSE5_FSM-6.3
- Exam Name: Fortinet NSE 5 - FortiSIEM 6.3
- Certification Provider: Fortinet
- Latest update: Oct 22,2026
Question #51
Device discovery information is stored in which database?
- A . CMDB
- B . Profile DB
- C . Event DB
- D . SVN DB
Correct Answer: A
A
Explanation:
Device Discovery Information: Information about discovered devices, including their configurations and statuses, is stored in a specific database.
CMDB: The Configuration Management Database (CMDB) is used to store detailed information about the devices discovered by FortiSIEM.
Function: It maintains comprehensive details about device configurations, relationships, and other metadata essential for managing the IT infrastructure.
Significance: Storing discovery information in the CMDB ensures that the FortiSIEM system has a centralized repository of device information, facilitating efficient management and monitoring.
Reference: FortiSIEM 6.3 User Guide, Configuration Management Database (CMDB) section, which details the storage and usage of device discovery information.
A
Explanation:
Device Discovery Information: Information about discovered devices, including their configurations and statuses, is stored in a specific database.
CMDB: The Configuration Management Database (CMDB) is used to store detailed information about the devices discovered by FortiSIEM.
Function: It maintains comprehensive details about device configurations, relationships, and other metadata essential for managing the IT infrastructure.
Significance: Storing discovery information in the CMDB ensures that the FortiSIEM system has a centralized repository of device information, facilitating efficient management and monitoring.
Reference: FortiSIEM 6.3 User Guide, Configuration Management Database (CMDB) section, which details the storage and usage of device discovery information.
Question #51
Device discovery information is stored in which database?
- A . CMDB
- B . Profile DB
- C . Event DB
- D . SVN DB
Correct Answer: A
A
Explanation:
Device Discovery Information: Information about discovered devices, including their configurations and statuses, is stored in a specific database.
CMDB: The Configuration Management Database (CMDB) is used to store detailed information about the devices discovered by FortiSIEM.
Function: It maintains comprehensive details about device configurations, relationships, and other metadata essential for managing the IT infrastructure.
Significance: Storing discovery information in the CMDB ensures that the FortiSIEM system has a centralized repository of device information, facilitating efficient management and monitoring.
Reference: FortiSIEM 6.3 User Guide, Configuration Management Database (CMDB) section, which details the storage and usage of device discovery information.
A
Explanation:
Device Discovery Information: Information about discovered devices, including their configurations and statuses, is stored in a specific database.
CMDB: The Configuration Management Database (CMDB) is used to store detailed information about the devices discovered by FortiSIEM.
Function: It maintains comprehensive details about device configurations, relationships, and other metadata essential for managing the IT infrastructure.
Significance: Storing discovery information in the CMDB ensures that the FortiSIEM system has a centralized repository of device information, facilitating efficient management and monitoring.
Reference: FortiSIEM 6.3 User Guide, Configuration Management Database (CMDB) section, which details the storage and usage of device discovery information.
Question #53
Where do you configure rule notifications and automated remediation on FortiSIEM?
- A . Notification policy
- B . Remediation policy
- C . Notification engine
- D . Remediation engine
Correct Answer: A
A
Explanation:
Rule Notifications and Automated Remediation: In FortiSIEM, notifications and automated remediation actions can be configured to respond to specific incidents or alerts generated by rules. Notification Policy: This is the section where administrators configure the settings for notifications and specify the actions to be taken when a rule triggers an alert.
Configuration Options: Includes defining the recipients of notifications, the type of notifications (e.g., email, SMS), and any automated remediation actions that should be executed.
Importance: Proper configuration of notification policies ensures timely alerts and automated responses to incidents, enhancing the effectiveness of the SIEM system.
Reference: FortiSIEM 6.3 User Guide, Notifications and Automated Remediation section, which details how to configure notification policies for rule-triggered actions and responses.
A
Explanation:
Rule Notifications and Automated Remediation: In FortiSIEM, notifications and automated remediation actions can be configured to respond to specific incidents or alerts generated by rules. Notification Policy: This is the section where administrators configure the settings for notifications and specify the actions to be taken when a rule triggers an alert.
Configuration Options: Includes defining the recipients of notifications, the type of notifications (e.g., email, SMS), and any automated remediation actions that should be executed.
Importance: Proper configuration of notification policies ensures timely alerts and automated responses to incidents, enhancing the effectiveness of the SIEM system.
Reference: FortiSIEM 6.3 User Guide, Notifications and Automated Remediation section, which details how to configure notification policies for rule-triggered actions and responses.
Question #54
A customer is experiencing slow performance while executing long, adhoc analytic searches.
Which FortiSIEM component can make the searches run faster?
- A . Correlation worker
- B . Event worker
- C . Storage worker
- D . Query worker
Correct Answer: D
D
Explanation:
Component Roles in FortiSIEM: Different components in FortiSIEM have specific roles and responsibilities, which contribute to the overall performance and functionality of the system.
Query Worker: The query worker component is specifically designed to handle and optimize search queries within FortiSIEM.
Function: It processes search requests and executes analytic searches efficiently, handling large volumes of data to provide quick results.
Optimization: By improving the efficiency of query execution, the query worker can significantly speed up long, ad hoc analytic searches, addressing performance issues.
Performance Impact: Utilizing the query worker ensures that searches are handled by a component optimized for such tasks, reducing the load on other components and improving overall system performance.
Reference: FortiSIEM 6.3 User Guide, System Components section, which describes the roles of different workers, including the query worker, and their impact on system performance.
D
Explanation:
Component Roles in FortiSIEM: Different components in FortiSIEM have specific roles and responsibilities, which contribute to the overall performance and functionality of the system.
Query Worker: The query worker component is specifically designed to handle and optimize search queries within FortiSIEM.
Function: It processes search requests and executes analytic searches efficiently, handling large volumes of data to provide quick results.
Optimization: By improving the efficiency of query execution, the query worker can significantly speed up long, ad hoc analytic searches, addressing performance issues.
Performance Impact: Utilizing the query worker ensures that searches are handled by a component optimized for such tasks, reducing the load on other components and improving overall system performance.
Reference: FortiSIEM 6.3 User Guide, System Components section, which describes the roles of different workers, including the query worker, and their impact on system performance.
Question #55
What is a prerequisite for FortiSIEM Linux agent installation?
- A . The web server must be installed on the Linux server being monitored
- B . The auditd service must be installed on the Linux server being monitored
- C . The Linux agent manager server must be installed.
- D . Both the web server and the audit service must be installed on the Linux server being monitored
Correct Answer: B
B
Explanation:
FortiSIEM Linux Agent: The FortiSIEM Linux agent is used to collect logs and performance metrics from Linux servers and send them to the FortiSIEM system.
Prerequisite for Installation: The auditd service, which is the Linux Audit Daemon, must be installed and running on the Linux server to capture and log security-related events.
auditd Service: This service collects and logs security events on Linux systems, which are essential for
monitoring and analysis by FortiSIEM.
Importance of auditd: Without the auditd service, the FortiSIEM Linux agent will not be able to collect the necessary event data from the Linux server.
Reference: FortiSIEM 6.3 User Guide, Linux Agent Installation section, which lists the prerequisites and steps for installing the FortiSIEM Linux agent.
B
Explanation:
FortiSIEM Linux Agent: The FortiSIEM Linux agent is used to collect logs and performance metrics from Linux servers and send them to the FortiSIEM system.
Prerequisite for Installation: The auditd service, which is the Linux Audit Daemon, must be installed and running on the Linux server to capture and log security-related events.
auditd Service: This service collects and logs security events on Linux systems, which are essential for
monitoring and analysis by FortiSIEM.
Importance of auditd: Without the auditd service, the FortiSIEM Linux agent will not be able to collect the necessary event data from the Linux server.
Reference: FortiSIEM 6.3 User Guide, Linux Agent Installation section, which lists the prerequisites and steps for installing the FortiSIEM Linux agent.
Question #56
An administrator is using SNMP and WMI credentials to discover a Windows device.
How will the WMI method handle this?
- A . WMI method will collect only traffic and IIS logs.
- B . WMI method will collect only DNS logs.
- C . WMI method will collect only DHCP logs.
- D . WMI method will collect security, application, and system events logs.
Correct Answer: A
A
Explanation:
WMI Method: Windows Management Instrumentation (WMI) is a set of specifications from Microsoft for consolidating the management of devices and applications in a network.
Log Collection: WMI is used to collect various types of logs from Windows devices.
Security Logs: Contains records of security-related events such as login attempts and resource access.
Application Logs: Contains logs generated by applications running on the system.
System Logs: Contains logs related to the operating system and its components.
Comprehensive Data Collection: By using WMI, FortiSIEM can gather a wide range of event logs that are crucial for monitoring and analyzing the security and performance of Windows devices.
Reference: FortiSIEM 6.3 User Guide, Data Collection Methods section, which details the use of WMI for collecting event logs from Windows devices.
A
Explanation:
WMI Method: Windows Management Instrumentation (WMI) is a set of specifications from Microsoft for consolidating the management of devices and applications in a network.
Log Collection: WMI is used to collect various types of logs from Windows devices.
Security Logs: Contains records of security-related events such as login attempts and resource access.
Application Logs: Contains logs generated by applications running on the system.
System Logs: Contains logs related to the operating system and its components.
Comprehensive Data Collection: By using WMI, FortiSIEM can gather a wide range of event logs that are crucial for monitoring and analyzing the security and performance of Windows devices.
Reference: FortiSIEM 6.3 User Guide, Data Collection Methods section, which details the use of WMI for collecting event logs from Windows devices.
Question #57
When configuring collectors located in geographically separated sites, what ports must be open on a front end firewall?
- A . HTTPS, from the collector to the worker upload settings address only
- B . HTTPS, from the collector to the supervisor and worker upload settings addresses
- C . HTTPS, from the Internet to the collector
- D . HTTPS, from the Internet to the collector and from the collector to the FortiSIEM cluster
Correct Answer: B
B
Explanation:
FortiSIEM Architecture: In FortiSIEM, collectors gather data from various sources and send this data to supervisors and workers within the FortiSIEM architecture.
Communication Requirements: For collectors to effectively send data to the FortiSIEM system, specific communication channels must be open.
Port Usage: The primary port used for secure communication between the collectors and the FortiSIEM infrastructure is HTTPS (port 443).
Network Configuration: When configuring collectors in geographically separated sites, the HTTPS port must be open for the collectors to communicate with both the supervisor and the worker upload settings addresses. This ensures that the collected data can be securely transmitted to the appropriate processing and analysis components.
Reference: FortiSIEM 6.3 Administration Guide, Network Ports section details the necessary ports for communication within the FortiSIEM architecture.
B
Explanation:
FortiSIEM Architecture: In FortiSIEM, collectors gather data from various sources and send this data to supervisors and workers within the FortiSIEM architecture.
Communication Requirements: For collectors to effectively send data to the FortiSIEM system, specific communication channels must be open.
Port Usage: The primary port used for secure communication between the collectors and the FortiSIEM infrastructure is HTTPS (port 443).
Network Configuration: When configuring collectors in geographically separated sites, the HTTPS port must be open for the collectors to communicate with both the supervisor and the worker upload settings addresses. This ensures that the collected data can be securely transmitted to the appropriate processing and analysis components.
Reference: FortiSIEM 6.3 Administration Guide, Network Ports section details the necessary ports for communication within the FortiSIEM architecture.