Fortinet FCP_FSM_AN-7.2 시험

Question No : 1

Refer to the exhibit.



If you group the events by User and Count attributes, how many results will FortiSIEM display?

• A.Two
• B.Six
• C.Three
• D.Five
• E.One

답을 확인하기

정답:
Explanation:
Grouping by User and Count yields five unique pairs: (Mike,4), (Bob,3), (Alice,2), (Bob,6), (Mike,5).

Question No : 2

What are two required components of a rule? (Choose two.)

• A.Exception policy
• B.Subpattern
• C.Detection Technology
• D.Clear policy

답을 확인하기

정답:
Explanation:
A Subpattern defines the specific conditions or event patterns the rule is designed to detect, and the Detection Technology specifies the type of detection logic (e.g., real-time, historical). Both are essential for a rule to function in FortiSIEM.

Question No : 3

Which two settings must you configure to allow FortiSIEM to apply tags to devices in FortiClient EMS? (Choose two.)

• A.FortiEMS API credentials defined on FortiSIEM
• B.Remediation script configured
• C.ZTNA tags defined on FortiSIEM
• D.FortiSIEM API credentials defined on FortiEMS\

답을 확인하기

정답:
Explanation:
To allow FortiSIEM to apply tags to devices in FortiClient EMS, FortiEMS API credentials must be defined on FortiSIEM to enable communication with EMS, and FortiSIEM API credentials must be defined on FortiEMS to allow EMS to accept tagging instructions from FortiSIEM. This bidirectional API trust is essential for tag application.

Question No : 4

Refer to the exhibit.



What will happen when a device being analyzed by the machine learning configuration shown in the exhibit has a consistently high memory utilization?

• A.FortiSIEM will update the regression tables for memory utilization, and average sent and received bytes.
• B.FortiSIEM will trigger an incident for high memory utilization.
• C.FortiSIEM will lower the CPU utilization trigger requirement for CPU utilization.
• D.FortiSIEM will update the model with a higher memory utilization average value.

답을 확인하기

정답:
Explanation:
In the configuration shown, FortiSIEM uses Memory Util, Sent Bytes, and Received Bytes as input features to predict CPU Utilization via a regression model. If a device shows consistently high memory utilization, the model will incorporate that into its training data and update itself with a higher average value for memory utilization, influencing future CPU utilization predictions.

Question No : 5

Refer to the exhibit.



An analyst is trying to generate an incident with a title that includes the Source IP, Destination IP, User, and Destination Host Name. They are unable to add a Destination Host Name as an incident attribute.
What must be changed to allow the analyst to select Destination Host Name as an attribute?

• A.The Destination Host Name must be selected as a Triggered Attribute.
• B.The Destination Host Name must be set as an aggregate item in a subpattern.
• C.The Destination Host Name must be added as an Event type in the FortiSIE
• D.The Destination IP Event Attribute must be removed.

답을 확인하기

정답:
Explanation:
For an attribute like Destination Host Name to be used in the incident title, it must first be included in the Triggered Attributes list. Only attributes listed there are available for substitution in the title template (e.g., $destIpAddr, $srcIpAddr).

Question No : 6

Which analytics search can be used to apply a user and entity behavior analytics (UEBA) tag to an event for a failed login by the user JSmith?

• A.User = smith
• B.Username NOT END WITH jsmith
• C.User IS jsmith
• D.Username CONTAIN smit

답을 확인하기

정답:
Explanation:
The correct syntax to match an exact username in FortiSIEM analytics search is User IS jsmith. This ensures that the UEBA tag is applied only when the event is specifically tied to the user "jsmith", which is required for accurate behavioral analytics.

Question No : 7

Refer to the exhibit.



If you group the events by Reporting Device, Reporting IP, and Application Category, how many results will FortiSIEM display?

• A.Four
• B.Five
• C.One
• D.Six
• E.Two

답을 확인하기

정답:
Explanation:
Grouping by Reporting Device, Reporting IP, and Application Category yields five unique tuples: (FW01, 10.1.1.1, DB), (FW02, 10.1.1.2, WebApp), (FW01, 10.1.1.1, SSH), (FW03, 10.1.1.3, DB), and (FW04, 10.1.1.4, SSH).

Question No : 8

Refer to the exhibit.



The analyst is troubleshooting the analytics query shown in the exhibit.
Why is this search not producing any results?

• A.The Time Range is set incorrectly.
• B.The inner and outer nested query attribute types do not match.
• C.You cannot reference User and Event Type attributes in the same search.
• D.The Boolean operator is wrong between the attributes.

답을 확인하기

정답:
Explanation:
The issue is that the "User" attribute is incorrectly assigned a Device IP group value, which is a mismatch of attribute types. "User" expects a user name or identity, not a device IP group. This mismatch between the attribute type and the provided value causes the search to return no results.

Question No : 9

Which running mode takes the most time to perform machine learning tasks?

• A.Local auto
• B.Local
• C.Forecasting
• D.Regression

답을 확인하기

정답:
Explanation:
In Local mode, FortiSIEM performs machine learning tasks using the full dataset without optimization shortcuts, making it the most time-consuming mode compared to Local Auto, Forecasting, or Regression.

Question No : 10

Which statement about thresholds is true?

• A.FortiSIEM uses fixed, hardcoded global and device thresholds for all performance metrics.
• B.FortiSIEM uses only device thresholds for security metrics.
• C.FortiSIEM uses global and per device thresholds for performance metrics.
• D.FortiSIEM uses only global thresholds for performance metrics.

답을 확인하기

정답:
Explanation:
FortiSIEM evaluates performance metrics against both global thresholds, which apply system-wide, and per-device thresholds, which can be customized for individual devices. This dual approach allows flexibility in monitoring while ensuring consistent baseline alerting