Free FCP_FSM_AN-7.2: FCP - FortiSIEM 7.2 Analyst Exam Questions and Answers

An analyst wants an incident triggered by a rule to clear automatically when the matching events stop occurring for 10 minutes. Which rule component should the analyst configure?

• AA. Clear Condition
• BB. Incident Attributes
• CC. Actions
• DD. Aggregate Conditions

An analyst is creating a rule that triggers when a single source IP connects to more than 50 different destination ports on the same destination IP within 2 minutes. Which two settings must the analyst configure in the rule subpattern? (Choose two.)

Select 2 answers.

• AA. Group By: Source IP, Destination IP
• BB. Aggregate: COUNT(DISTINCT Destination Port) > 50
• CC. Group By: Destination Port
• DD. Aggregate: COUNT(Matched Events) > 50

An analyst maintains a watch list named Contractor_IPs that contains the IP addresses used by third-party contractors. The analyst needs an analytics search that returns only events whose Source IP is in that list. How should the analyst build the filter condition?

• AA. Source IP IN Contractor_IPs
• BB. Reporting IP IN Contractor_IPs
• CC. Source IP = Contractor_IPs
• DD. Source IP CONTAIN Contractor_IPs

An analyst needs a search result that shows, for each user, how many different destination IP addresses the user connected to in the last hour. How should the analyst configure the search?

• AA. Group by User and aggregate COUNT(Matched Events)
• BB. Group by Destination IP and aggregate COUNT(DISTINCT User)
• CC. Group by User and aggregate COUNT(DISTINCT Destination IP)
• DD. Group by Destination IP and aggregate COUNT(Matched Events)

An analyst needs a rule that triggers when a single source IP generates failed logins against 10 or more different hosts within 5 minutes. Which two settings in the rule subpattern meet this requirement? (Choose two.)

Select 2 answers.

• AA. Group by Source IP
• BB. Group by Host IP
• CC. Aggregate COUNT(Matched Events) >= 10
• DD. Aggregate COUNT(DISTINCT Host IP) >= 10

An analyst wants the incident created by a failed login rule to clear automatically when the same user logs in successfully. Which rule component should the analyst configure?

• AA. Notification policy
• BB. Subpattern aggregate
• CC. Clear condition
• DD. Triggered attributes

Refer to the exhibit. Exhibit: Automation policy: Quarantine-Host Remediation: Apply tag in FortiClient EMS Tag: Compromised-Host FortiClient EMS: endpoint WS-114 has tag Compromised-Host FortiGate ZTNA policy Allow-Finance-App: ZTNA tag IN (Domain-Joined) FortiGate log: WS-114 accessed finance-app.example.com, action accept The rule associated with the automation policy triggered for WS-114, and the tag was applied successfully. WS-114 can still reach the finance application through the ZTNA access proxy. Why?

• AA. The tag takes effect only after the incident is cleared in the FortiSIEM incident list.
• BB. The FortiGate ZTNA policy does not reference the Compromised-Host tag, so the tag does not change the access decision.
• CC. FortiSIEM can apply ZTNA tags only through the FortiGate, so FortiClient EMS ignores the tag.
• DD. The tag must be applied to the endpoint IP address instead of the host name before FortiGate honors it.

Before FortiSIEM can run a remediation script against a network device, what must be defined for that device?

• AA. A dedicated Collector in the device organization
• BB. A scheduled report that lists the device
• CC. Access credentials mapped to the device IP address
• DD. A custom parser for the device event types

An analyst must create a rule that triggers when five or more failed logons to a firewall are followed by a successful logon. Which two actions must the analyst take? (Choose two.)

Select 2 answers.

• AA. Define a second subpattern that filters for successful logon events
• BB. Create a second rule for successful logons and chain it with a notification policy
• CC. Connect the two subpatterns with the FOLLOWED_BY relationship
• DD. Add both event types to the filter of a single subpattern with COUNT(*) >= 5

Refer to the exhibit. Exhibit: Rule: Excessive Failed Logons Subpattern: Failed_Logon Filter: Event Type = Win-Security-4625 Group By: Reporting IP Aggregate: COUNT(Matched Events) >= 10 Time window: 300 seconds The analyst wants the rule to trigger when a single user account fails to log on 10 times within 5 minutes on a server, not when 10 failures from all accounts combined occur on that server. What should the analyst change in the subpattern?

• AA. Add a second subpattern with the same filter and no Group By
• BB. Add User to the Group By attributes of the subpattern
• CC. Replace the aggregate with COUNT(DISTINCT User) >= 10
• DD. Increase the time window from 300 seconds to 3600 seconds