Online Access Free FCP_FSM_AN-7.2 Exam Questions

How does FortiSIEM update the incident table if a performance rule triggers repeatedly?

• A.FortiSIEM generates a new incident based on the Rule Frequency value, and updates the First Seen and Last Seen timestamps.
• B.FortiSIEM updates the Incident Count value and Last Seen timestamp.
• C.FortiSIEM generates a new incident each time the rule triggers, and updates the First Seen and Last Seen timestamps.
• D.FortiSIEM changes the incident status to Repeated, and updates the Last Seen timestamp.

Which two settings must you configure to allow FortiSIEM to apply tags to devices in FortiClient EMS? (Choose two.)

• A.FortiEMS API credentials defined on FortiSIEM
• B.ZTNA tags defined on FortiSIEM
• C.Remediation script configured
• D.FortiSIEM API credentials defined on FortiEMS\

Refer to the exhibit.

If you group the events by User and Count attributes, how many results will FortiSIEM display?

• A.Two
• B.Five
• C.Six
• D.One
• E.Three

Refer to the exhibit.

As shown in the exhibit, why are some of the fields highlighted in red?

• A.Unique values cannot be grouped B.
• B.The attribute COUNT(Matched Events) is an invalid expression.
• C.No RAW Event Log attribute information is available.
• D.The Event Receive Time attribute is not available for logs.

Which information can FortiSIEM retrieve from FortiClient EMS through an API connection?

• A.Host login credentials
• B.ZTNA tags
• C.FortiSIEM license
• D.Host software versions