Online Access Free FCP_FSM_AN-7.2 Exam Questions

Refer to the exhibit.

According to the automation policy configuration shown in the exhibit, what happens if an associated rule triggers?

• A.FortiSIEM performs all selected actions.
• B.FortiSIEM runs the remediation script, because that takes precedence over all other options.
• C.FortiSIEM sends an email, because that is first on the list.
• D.FortiSIEM fails to the integration policy, because no policy is defined.

What are two required components of a rule? (Choose two.)

• A.Exception policy
• B.Subpattern
• C.Clear policy
• D.Detection Technology

Refer to the exhibit.

How was this incident cleared?

• A.The incident was cleared automatically by the rule.
• B.The analyst manually cleared the incident from the incident table.
• C.The endpoint was rebooted and sent an all-clear signal to FortiSIEM.
• D.FortiSIEM cleared the incident automatically after 24 hours.

How does FortiSIEM update the incident table if a performance rule triggers repeatedly?

• A.FortiSIEM updates the Incident Count value and Last Seen timestamp.
• B.FortiSIEM changes the incident status to Repeated, and updates the Last Seen timestamp.
• C.FortiSIEM generates a new incident each time the rule triggers, and updates the First Seen and Last Seen timestamps.
• D.FortiSIEM generates a new incident based on the Rule Frequency value, and updates the First Seen and Last Seen timestamps.

Refer to the exhibit.

An analyst is trying to identify an issue using an expression based on the Expression Builder settings shown in the exhibit; however, the error message shown in the exhibit indicates that the expression is invalid.
What is the correct syntax to create an expression that generates a total count of matched events?

• A.COUNT(Matched Events)
• B.Matched Events (COUNT)
• C.Matched Events COUNT()
• D.(COUNT) Matched Events