View all questions & answers for the NSE 6 - FortiSIEM 7.2 Analyst Exam Materials exam
NSE 6 - FortiSIEM 7.2 Analyst Exam Materials - Question #29 Discussion
Community Explanations & Comments (4)
Zaid Haitham
1 year ago
Selected: C
Explanation:
the attribute AVG(CPU Util) has operator (>) not (>=)
the attribute AVG(CPU Util) has operator (>) not (>=)
Brave-Dumps.com Admin
1 year ago
I think C is not correct.
Because the rule has two conditions for each host within the 10-minute window:
COUNT(Matched Events) ≥ 2
AVG(CPU Util) > Critical Threshold (from the CMDB for each server)
What do you think?
Zaid Haitham
1 year ago
Maybe You're right.
Sanchit Gupta
11 months ago
Selected: C
COUNT(MATCH EVENTS) >= 2 in the 10-minute window.
Neither server meets the threshold even once, so neither can reach count ≥2.
C is correct
Neither server meets the threshold even once, so neither can reach count ≥2.
C is correct
Sanchit Gupta
11 months ago
Selected: A
Ignore my comment please or if possible please delete. A is correct as threshold is 90
Anonymous User
5 months ago
Selected: A
Server A will generate one incident and Server B will not generate any incidents.
Refer to the exhibits. Three events are collected over 10 minutes from two servers: Server A and Server B. Based on the settings for the rule subpattern and a 10-minute condition window, how many incidents will the servers generate? (Choose one answer)
Brave-Dump Community Votes