Fortinet FCP_FSM_AN-7.2 Exam Questions Instant Access

Question 1

Refer to the exhibit.

What happens when an analyst clears an incident generated by a rule containing the automation policy shown in the exhibit?

ANo notification is sent.

BAn email is sent to the SOC manager.

CThe remediation script is run.

DA notification is sent to the SOC manager dashboard.

Answer : A

The automation policy has the option 'Do not notify when an incident is cleared manually' enabled. Therefore, when an analyst manually clears an incident, no notification or automation action is triggered.

Question 2

Refer to the exhibit.

Which two conditions will match this rule and subpatterns? (Choose two.)

AA user using RDP over SSL VPN fails to log in to an application five times.

BA user runs a brute force password cracker against an RDP server.

CA user fails twice to log in when connecting through RDP.

DA user connects to the wrong IP address for an RDP session five times.

Answer : A, B

The user initiates an RDP session (Subpattern 1) and then fails to log in multiple times (Subpattern 2 with COUNT(Matched Events) >= 3) - both from the same Source IP and User within 300 seconds.

The brute force attempts typically involve a successful RDP connection followed by multiple failed logins, satisfying the sequence and grouping conditions in the rule.

Question 3

Refer to the exhibit.

If you group the events by Reporting Device, Reporting IP, and Application Category, how many results will FortiSIEM display?

AFour

BFive

COne

DSix

ETwo

Answer : B

Grouping by Reporting Device, Reporting IP, and Application Category yields five unique tuples: (FW01, 10.1.1.1, DB), (FW02, 10.1.1.2, WebApp), (FW01, 10.1.1.1, SSH), (FW03, 10.1.1.3, DB), and (FW04, 10.1.1.4, SSH).

Question 4

Refer to the exhibit.

Which value would you expect the FortiSIEM parser to use to populate the Application Name field?

Aapplist

BNetwork.Service

CSSL

Dwan1

Answer : C

The Application Name field in FortiSIEM is typically populated using the value of the app field in the raw log. In this event, app='SSL', so 'SSL' is the expected application name parsed by FortiSIEM.

Question 5

When configuring anomaly detection machine learning, in which step must you select the fields to analyze?

ADesign

BSchedule

CPrepare Data

DTrain

Answer : C

In the Prepare Data step of configuring anomaly detection in FortiSIEM, you must select the fields to analyze. This step defines the input features that the machine learning model will evaluate during training and detection.

Question 6

Refer to the exhibit.

If a rule containing the automation policy shown in the exhibit triggers, what will happen?

AAssociated source IP addresses will be blocked on devices in the Aviation organization.

BAssociated source IP addresses will be blocked on all FortiGate firewalls.

CAssociated source IP addresses will be blocked on devices in the Network CMDB group.

DAssociated source IP addresses will be blocked on two FortiGate firewalls.

Answer : D

The automation policy is configured to run a remediation script named 'Fortinet FortiOS - Block Source IP FortiOS via API'. It specifies enforcement on two FortiGate devices: FortiGate508 and FortiGate90D. Therefore, associated source IP addresses will be blocked on those two FortiGate firewalls only.

Question 7

Refer to the exhibit.

An analyst is troubleshooting the rule shown in the exhibit. It is not generating any incidents, but the filter parameters are generating events on the Analytics tab.

What is wrong with the rule conditions?

AThe Event Type refers to a CMDB lookup and should be an Event lookup.

BThe Destination Host Name value is not fully qualified.

CThe Group By attributes restricts which events are counted.

DThe Aggregate attribute is too restrictive.

Answer : C

The Group By attributes - Destination IP and User - cause the aggregation (COUNT(Source IP) >= 2) to apply within each unique combination of those groupings. This restricts the count calculation and can prevent the rule from triggering incidents, even if matching events exist in the Analytics tab.

Fortinet FCP - FortiSIEM 7.2 Analyst FCP_FSM_AN-7.2 Exam Questions