The FortiSIEM 7.4 Analyst exam (Fortinet NSE 6 - FortiSIEM 7.4 Analyst, NSE6_FSM_AN-7.4) gives you 35 to 40 questions in 70 minutes, is scored pass or fail, and costs US$210 from November 2, 2026. It tests whether you can use FortiSIEM to search, enrich and analyze security events, not whether you can install it.
That last point shapes everything about how you should prepare. This is an analyst exam. The questions sit where a SOC analyst spends the day: building a query, turning it into a rule, tuning the incident that rule raises, and deciding what happens next. This entry goes through the five topic areas on Fortinet's exam page, the fee change that took effect yesterday, a five-week study plan, the mistakes that cost people the most, and one worked rule scenario written from scratch. Every exam fact below was checked on Fortinet's and Pearson VUE's own pages on 3 November 2026.
What is the FortiSIEM 7.4 Analyst exam?
It is one of the exams in Fortinet's NSE 6 Security Operations track, aimed at people who detect, analyze and remediate security incidents with FortiSIEM. Fortinet released the 7.4 version on February 12, 2026, and retired the FortiSIEM 7.2 Analyst exam on June 15, 2026.
The FortiSIEM Analyst exam page on the Fortinet Training Institute describes the exam as a test of applied knowledge of FortiSIEM analytics. It names four kinds of content: operational scenarios, incident analysis, integration with ZTNA, and troubleshooting scenarios.
The key facts from that page:
- Exam time: 70 minutes.
- Questions: 35 to 40.
- Scoring: pass or fail. Fortinet does not publish a numeric pass mark. Your score report is in your Pearson account.
- Language: English.
- Product version: FortiSIEM 7.4.
- Recommended experience: at least 6 months of practical FortiSIEM administration, or an equivalent SIEM product.
The same page also lists an older-style "FCP - FortiSIEM 7.X Analyst" exam with 60 minutes, 30 to 35 questions, and English and Japanese. When you book, check that the exam name on the screen matches the version you studied.
How much does the FortiSIEM 7.4 Analyst exam cost now?
The exam costs US$210 plus tax from November 2, 2026. Before that date, every NSE 4 to NSE 7 exam was US$200.
Fortinet announced the change in its notice on changes to NSE exam fees, updated on October 5, 2026. NSE 4 to 6 exams and their recertification assessments are now US$210, and NSE 7 exams are US$420. If a study guide or a forum post still says US$200, it was written before the change.
Two smaller points from the same notice matter if you buy vouchers. A voucher bought for a Pearson-proctored exam cannot be used for a recertification assessment, and the reverse is also true. Buy the right kind.
What topics does the exam cover?
Fortinet lists five topic areas and gives no weights, so you cannot tell from the page which area carries the most questions. Treat them as equally likely and spend extra time on the ones you use least at work.
- Analytics. Build queries from search results and events, apply group by and data aggregation, run CMDB and lookup table queries, and perform nested query lookups.
- FortiEDR security settings and policies. Communication control policy, security policies, playbooks, and explaining Fortinet Cloud Service (FCS). This block is printed on the 7.4 exam page as it stands today, so read it there before you book and decide how much time to give it.
- Rules and subpatterns. Identify rule components, use subpatterns with aggregation and group by, and configure FortiSIEM analytics rules.
- Incidents, notifications, and remediation. Manage and tune incidents, configure notification policies, and configure remediation options.
- ML, UEBA, and ZTNA. Machine learning configuration tasks, bringing UEBA data into rules and dashboards, and describing how ZTNA fits into FortiSIEM operations.
Look at the verbs. Most of them are "build", "apply", "perform" and "configure". Only one task says "describe". That tells you the exam expects you to have done these things in a console, not just read about them.
Which certification does the exam count toward?
Passing it counts toward the NSE 6 in Security Operations certification, but it is not enough on its own. The NSE 6 Security Operations certification page says you must hold the NSE 4 FortiOS certification and pass one of the proctored NSE 6 Security Operations exams within 2 years.
The FortiSIEM Analyst exam shares that track with four others: FortiNDR Cloud Analyst, FortiSOAR Analyst, FortiRecon Analyst and FortiDeceptor Administrator. The certification is valid for 2 years from the date you complete the last requirement.
Renewal has one catch. Renewing NSE 6 needs an active NSE 4 FortiOS certification. If your NSE 4 has lapsed, Fortinet holds the NSE 6 until you earn NSE 4 again, and you have 2 years to do it.
How are the questions scored?
Fortinet's rules for all NSE exams are short and strict. Questions are multiple choice and drag-and-drop. An answer must be 100% correct to get credit, so a question with three correct choices gives you nothing if you pick two. There is no partial credit and no deduction for a wrong answer.
That last rule means you should never leave a question blank. A guess costs you nothing.
Retake rules: if you fail, you wait 15 days before trying again. You cannot retake an exam you have already passed. After a pass, your Fortinet Training Institute account updates within 5 business days.
Other vendors work differently. Palo Alto's NetSec-Pro, for example, publishes domain weights and a scaled pass mark, as this blog's walkthrough of the Palo Alto NetSec-Pro blueprint shows. With Fortinet you only learn pass or fail, so you cannot aim for a target score.
How do you book the exam?
You book through Pearson VUE's Fortinet page, at a test center or online with OnVUE. Fortinet removed OnVUE from four NSE 7 exams on September 21, 2026, but its notice says NSE 4, NSE 5 and NSE 6 exams keep both options.
Test center appointments can be moved or cancelled up to 24 hours before the start through your Pearson account. Pick the date after week 4 of the plan below, not before you start studying. A fixed date helps, but a date set too early pushes people into the exam with the rules topic half done.
What is a good five-week study plan?
Five weeks fits someone who already works with a SIEM. If FortiSIEM is new to you, double each week. The plan follows the order of the work: query, rule, incident, response.
- Week 1: Analytics. Run searches every day. Build a query from an event you can see, then add group by and aggregation. Practise CMDB queries and lookup tables, then write one nested query that uses the result of another. Keep a notebook of every query that worked.
- Week 2: Rules and subpatterns. Take three of your week 1 queries and turn them into rules. Learn each rule component by name. Write one rule with two subpatterns and see how aggregation and group by change when it fires.
- Week 3: Incidents, notifications and remediation. Trigger your own rules and work the incidents they raise. Tune one noisy rule until it stops firing on normal traffic. Set up a notification policy and look at every remediation option you can reach.
- Week 4: ML, UEBA, ZTNA and the FortiEDR block. Go through the machine learning tasks, then put UEBA data into a rule and a dashboard. Read the Agentless ZTNA with FortiSIEM UEBA and FortiGate guide that Fortinet recommends. Cover the FortiEDR and FCS items from the exam page.
- Week 5: Review and gaps. Re-read the five topic lists line by line and mark each task as done, shaky or never tried. Spend the week on the shaky and never-tried ones. Use the official sample questions inside the Fortinet course to check the style, then stop studying the day before the exam.
The FortiSIEM 7.4 User Guide on Fortinet's documentation site is the reference for all five weeks. When a task in the topic list confuses you, search the guide for its exact wording.
What does a full rule look like in practice?
Here is a scenario written for this entry, not taken from any exam. It shows how the five topic areas connect, which is how the exam likes to test them.
Your team wants to catch password guessing that succeeds. In week 1 terms, you start with a query: failed logins in the last hour, grouped by source IP and user, with a count. You see one source IP with 40 failures against one account.
Next, the rule. The first subpattern matches failed logins and aggregates them by source IP and user, firing when the count passes a threshold you choose. The second subpattern matches a successful login for the same user from the same source IP. The rule fires only when the second follows the first inside the time window. Without the group by on both fields, the rule would join unrelated failures and successes and raise false incidents.
Then the incident. The first week it fires twice on a service account that retries a stale password. You tune the rule to exclude that account through a lookup table, rather than raising the threshold for everyone.
Finally, response. A notification policy sends the incident to the on-call analyst, and a remediation option blocks the source IP. UEBA data on the user adds context, for example when the login comes at an hour that account never uses.
If you can build that chain yourself, you have touched four of the five topic areas in one exercise.
Which mistakes cost candidates the most?
These are the patterns that hurt most on a pass-or-fail exam with all-or-nothing scoring.
- Studying the old version. Material written for FortiSIEM 7.2 or 7.X is still around. The exam asks about 7.4, so check the product version on anything you use.
- Reading instead of building. Almost every task is a "configure" or "build" task. People who only read the guide struggle with questions that describe a console screen.
- Skipping the rules topic. Subpatterns, aggregation and group by are where most confusion lives. Give them a full week.
- Picking half of a multi-answer question. With no partial credit, read the question for how many answers it wants before you look at the options.
- Forgetting NSE 4. The exam badge comes on its own, but the NSE 6 certification needs an active NSE 4 FortiOS.
- Paying the old price in your budget. It is US$210 now, plus tax.
How can you check your readiness?
When you can explain each task on the exam page in your own words and show it in a console, you are close. If you want timed practice with questions laid out by these topic areas, the NWExam FortiSIEM 7.4 Analyst exam overview collects the syllabus, sample questions and practice test for this code in one place.
Is there a video overview of the FortiSIEM Analyst exam?
There is no NWExam video for the 7.4 version yet. The closest is this short overview of the FortiSIEM Analyst 7.2 exam. The format details in it belong to the older version, so use it for the topic picture and take the 7.4 facts from the list above.
Frequently asked questions
1. How many questions are on the FortiSIEM 7.4 Analyst exam?
Fortinet's exam page lists 35 to 40 questions in 70 minutes. The questions are multiple choice and drag-and-drop.
2. What is the passing score for NSE6_FSM_AN-7.4?
Fortinet does not publish a numeric passing score. The exam is scored pass or fail, and your score report is in your Pearson account.
3. How much does the FortiSIEM 7.4 Analyst exam cost?
From November 2, 2026 it costs US$210 plus tax, like every NSE 4 to NSE 6 exam. It was US$200 before that date.
4. Can I take the FortiSIEM 7.4 Analyst exam online?
Yes. Fortinet's OnVUE notice says NSE 6 exams stay available through both OnVUE online proctoring and Pearson VUE test centers.
5. Do I need NSE 4 before the FortiSIEM Analyst exam?
Fortinet's exam page lists no prerequisite for sitting the exam, and a pass earns you the exam badge. To earn the NSE 6 in Security Operations certification, you also need the NSE 4 FortiOS certification.