Fortinet Exam NSE5_FSM-6.3 Topic 2 Question 13 Discussion

Actual exam question for Fortinet's NSE5_FSM-6.3 exam

Question #: 13
Topic #: 2

Refer to the exhibit.

A FortiSIEM administrator wants to collect both SIEM event logs and performance and availability metrics (PAM) events from a Microsoft Windows server

Which protocol should the administrator select in the Access Protocol drop-down list so that FortiSIEM will collect both SIEM and PAM events?

ATELNET

BWMI

CLDAPS

DLDAP start TLS

Show Suggested Answer

Suggested Answer: B

Collecting SIEM and PAM Events: To collect both SIEM event logs and Performance and Availability Monitoring (PAM) events from a Microsoft Windows server, a suitable protocol must be selected.

WMI Protocol: Windows Management Instrumentation (WMI) is the appropriate protocol for this task.

SIEM Event Logs: WMI can collect security, application, and system logs from Windows devices.

PAM Events: WMI can also gather performance metrics, such as CPU usage, memory utilization, and disk activity.

Comprehensive Data Collection: Using WMI ensures that both types of data are collected efficiently from the Windows server.

Reference: FortiSIEM 6.3 User Guide, Data Collection Methods section, which details the use of WMI for collecting various types of logs and performance metrics.

by Luther at Sep 12, 2024, 08:04 PM

Limited Time Offer

25%

Off

Get Premium NSE5_FSM-6.3 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Martina

4 months ago

B) WMI, no doubt. Unless the admin is feeling particularly adventurous and wants to try out the 'Windows Carrier Pigeon Protocol' (patent pending).

upvoted 0 times

...

Cammy

4 months ago

Hmm, let's see. TELNET? Nah, that's so old-school. LDAPS? Maybe, but it's more for authentication than event collection. I'm gonna go with B) WMI. Gotta love that Windows management goodness!

upvoted 0 times

...

I think the correct protocol is WMI.

upvoted 0 times

...