View all questions & answers for the NSE 6 - FortiSIEM 7.2 Analyst Exam Materials exam


Question 15 Discussion

Refer to the exhibits. An analyst wants the rule shown in the exhibit to trigger when three failed login attempts occur within three minutes. What should the values be for the condition time window and aggregate count? (Choose one answer)

  • A. Time window 180 seconds, aggregate count 2
  • B. Time window 90 seconds, aggregate count 2
  • C. Time window 90 seconds, aggregate count 3
  • D. Time window 180 seconds, aggregate count 3
Correct Answer: A

Brave-Dump Clients Votes

A 50%
D 50%

Comments



Brave-Dumps Admin 2025-07-29 17:06:35

Selected Answers: A


Explaination: the time frame that the rule engine validates the data is 3 mins which is 180 sec and trigger when three failed login attempts occur so the cound should be greater than 2


Sanchit Gupta 2025-11-24 08:13:43

Selected Answers: D


To trigger a rule when three failed login attempts occur within three minutes (180 seconds), the condition time window must be set to 180 seconds and the aggregate count (or threshold) must be set to 3. This configuration ensures the rule only fires after the third failed attempt occurs within the specified timeframe.
  • Brave-Dumps Admin 2025-11-25 12:17:49
    A is the correct answer, The operator used in the aggregate condition is >, not ≥