NSE6-FSM-AN-7-4: Fortinet NSE 6 - FortiSIEM 7.4 Analyst

By Fortinet · Question Mode

QuestionQ35

VerifiedRules and subpatterns

Refer to the exhibit.

Question Image

If a user account becomes locked after five unsuccessful login attempts, how many times is this rule triggered when three individual users each fail to log in 10 times?

Explanation

The rule matches Domain Account Lockout events and groups them by reporting device, reporting IP, and user. Each of the three users generates one account-lockout event on reaching five failed attempts, so the grouped rule triggers once for each user: three times total.

Community Discussion

No comments yet. Be the first to start the discussion!