View all questions & answers for the NSE 6 - FortiSIEM 7.4 Analyst Exam Materials exam

NSE 6 - FortiSIEM 7.4 Analyst Exam Materials - Question #40 Discussion

Comment Image Comment Image Comment Image
Question Diagram

Refer to the exhibits. You are troubleshooting why the rule shown in the exhibit is generating incidents for successful Remote Desktop Protocol (RDP) connections with correct logins. It should only be triggering when a person fails a login three or more times to the target device when connecting with RDP. What is causing the rule to be triggered by correct login events? (Choose one answer)

  • A. The subpattern relationship `RDP_Connection:User = Failed_Logon:User` never matches.
  • B. The Boolean between the subpatterns is incorrect.
  • C. The attribute types in the subpatterns do not match.
  • D. The RDP login is different from the login used to access the target device.
Correct Answer: B

Brave-Dump Community Votes

Answer: B (2 votes) 100%

Community Explanations & Comments (2)

Anonymous User 4 months ago
Selected: B
Answer B is more logic ,
Why would C be the correct answer if the rule is still triggering incident for successful logins which indicates that attributes types are matching . and the question is mentioning should Only so AND is logical answer
Admin can you update ?
Anonymous User 3 weeks ago
Selected: B
I think answer should be B.