View all questions & answers for the NSE 6 - FortiSIEM 7.2 Analyst Exam Materials exam

NSE 6 - FortiSIEM 7.2 Analyst Exam Materials - Question #15 Discussion

Comment Image Comment Image Comment Image
Question Diagram

Refer to the exhibits. An analyst wants the rule shown in the exhibit to trigger when three failed login attempts occur within three minutes. What should the values be for the condition time window and aggregate count? (Choose one answer)

  • A. Time window 180 seconds, aggregate count 2
  • B. Time window 90 seconds, aggregate count 2
  • C. Time window 90 seconds, aggregate count 3
  • D. Time window 180 seconds, aggregate count 3
Correct Answer: A

Brave-Dump Community Votes

Answer: A (2 votes) 66.67%
Answer: D (1 vote) 33.33%

Community Explanations & Comments (3)

Brave-Dumps.com Admin 1 year ago
Selected: A
Explaination: the time frame that the rule engine validates the data is 3 mins which is 180 sec and trigger when three failed login attempts occur so the cound should be greater than 2
Sanchit Gupta 11 months ago
Selected: D
To trigger a rule when three failed login attempts occur within three minutes (180 seconds), the condition time window must be set to 180 seconds and the aggregate count (or threshold) must be set to 3. This configuration ensures the rule only fires after the third failed attempt occurs within the specified timeframe.
Brave-Dumps.com Admin 11 months ago
A is the correct answer, The operator used in the aggregate condition is >, not ≥
Adam 7 months ago
Selected: A
A