View all questions & answers for the NSE 6 - FortiSIEM 7.2 Analyst Exam Materials exam


Question 29 Discussion

Refer to the exhibits. Three events are collected over 10 minutes from two servers: Server A and Server B. Based on the settings for the rule subpattern and a 10-minute condition window, how many incidents will the servers generate? (Choose one answer)

  • A. Server A will generate one incident and Server B will not generate any incidents.
  • B. Server A will not generate any incidents and server B will generate one incident.
  • C. Server A will not generate any incidents and Server B will not generate any incidents.
  • D. Server A will generate one incident and Server B will generate one incident.
Correct Answer: A

Brave-Dump Clients Votes

C 66.67%
A 33.33%

Comments



Zaid Haitham 2025-09-12 19:12:04

Selected Answers: C


Explanation:
the attribute AVG(CPU Util) has operator (>) not (>=)
  • Brave-Dumps Admin 2025-09-14 12:55:02
    I think C is not correct. Because the rule has two conditions for each host within the 10-minute window: COUNT(Matched Events) ≥ 2 AVG(CPU Util) > Critical Threshold (from the CMDB for each server) What do you think?
  • Zaid Haitham 2025-09-15 23:54:50
    Maybe You're right.


Sanchit Gupta 2025-11-24 01:16:58

Selected Answers: C


COUNT(MATCH EVENTS) >= 2 in the 10-minute window.

Neither server meets the threshold even once, so neither can reach count ≥2.

C is correct


Sanchit Gupta 2025-11-24 01:18:55

Selected Answers: A


Ignore my comment please or if possible please delete. A is correct as threshold is 90