100% Real & Accurate FCP_FSM_AN-7.2 Questions and Answers with Free and Fast Updates [Q20-Q44]

Q20. Which analytics search can be used to apply a user and entity behavior analytics (UEBA) tag to an event for a failed login by the user JSmith?

User = smith

Username NOT END WITH jsmith

User IS jsmith

Username CONTAIN smit

Q21. Refer to the exhibit.

As shown in the exhibit, why are some of the fields highlighted in red?

Unique values cannot be grouped B.

The attribute COUNT(Matched Events) is an invalid expression.

No RAW Event Log attribute information is available.

The Event Receive Time attribute is not available for logs.

Q22. Which items are used to define a subpattern?

Filters, Aggregate, Group By definitions

Filters, Aggregate, Time Window definitions

Filters, Group By, Threshold definitions

Filters, Threshold, Time Window definitions

Q23. Refer to the exhibit.

An analyst is trying to identify an issue using an expression based on the Expression Builder settings shown in the exhibit; however, the error message shown in the exhibit indicates that the expression is invalid.
What is the correct syntax to create an expression that generates a total count of matched events?

COUNT(Matched Events)

(COUNT) Matched Events

Matched Events (COUNT)

Matched Events COUNT()

Q24. Refer to the exhibit.

What will happen when a device being analyzed by the machine learning configuration shown in the exhibit has a consistently high memory utilization?

FortiSIEM will update the regression tables for memory utilization, and average sent and received bytes.

FortiSIEM will trigger an incident for high memory utilization.

FortiSIEM will lower the CPU utilization trigger requirement for CPU utilization.

FortiSIEM will update the model with a higher memory utilization average value.

Q25. Refer to the exhibit.

Which two conditions will match this rule and subpatterns? (Choose two.)

A user using RDP over SSL VPN fails to log in to an application five times.

A user runs a brute force password cracker against an RDP server.

A user fails twice to log in when connecting through RDP.

A user connects to the wrong IP address for an RDP session five times.

Q26. Which two settings must you configure to allow FortiSIEM to apply tags to devices in FortiClient EMS? (Choose two.)

ZTNA tags defined on FortiSIEM

FortiSIEM API credentials defined on FortiEMS

FortiEMS API credentials defined on FortiSIEM

Remediation script configured

Q27. Refer to the exhibit.

What is the Group: FortiSIEM Analysts value referring to?

FortiSIEM organization group

LDAP user group

CMDB user group

Windows Active Directory user group

Q28. Refer to the exhibit.

A FortiSIEM device is receiving syslog events from a FortiGate firewall. The FortiSIEM analyst is trying to search the raw event logs for the last two hours that contain the keyword “udp”. However, they are getting no results from the search, which they know should be available. Based on the filter shown in the exhibit, why are there no search results?

The analyst selected AND in the Next column. This is the wrong Boolean operator.

The Time Range value should be set to Real-Time.

The keyword is case sensitive. Instead of typing udp in the Value field, the analyst should type UDP.

The analyst selected = in the Operator column. That is the wrong operator.

Q29. What can you use to send data to FortiSIEM for user and entity behavior analytics (UEBA)?

FortiSIEM agent

FortiSIEM worker

SSH

SNMP

Q30. Refer to the exhibit.

Which section contains the subpattern configuration that determines how many matching events are needed to trigger the rule?

Aggregate

Group By

Actions

Filters

Q31. How does FortiSIEM update the incident table if a performance rule triggers repeatedly?

FortiSIEM changes the incident status to Repeated, and updates the Last Seen timestamp.

FortiSIEM updates the Incident Count value and Last Seen timestamp.

FortiSIEM generates a new incident based on the Rule Frequency value, and updates the First Seen and Last Seen timestamps.

FortiSIEM generates a new incident each time the rule triggers, and updates the First Seen and Last Seen timestamps.

Q32. Refer to the exhibit.

An analyst is trying to generate an incident with a title that includes the Source IP, Destination IP, User, and Destination Host Name. They are unable to add a Destination Host Name as an incident attribute.
What must be changed to allow the analyst to select Destination Host Name as an attribute?