Fortinet FCP_FSM_AN-7.2 Exam Questions

Question 6 of 9

Refer to the exhibit.
Exam FCP_FSM_AN-7.2: Question 6 - Image 1

What happens when an analyst clears an incident generated by a rule containing the automation policy shown in the exhibit?

No notification is sent.

An email is sent to the SOC manager.

The remediation script is run.

A notification is sent to the SOC manager dashboard.

Correct Answer: A

Question 7 of 9

Refer to the exhibit.
Exam FCP_FSM_AN-7.2: Question 7 - Image 1

An analyst wants the rule shown in the exhibit to trigger when three failed login attempts occur within three minutes.
What should the values be for the condition time window and aggregate count?

Time window 180 seconds, aggregate count 3

Time window 180 seconds, aggregate count 2

Time window 90 seconds, aggregate count 3

Time window 90 seconds, aggregate count 2

Correct Answer: A

Question 8 of 9

Refer to the exhibit.
Exam FCP_FSM_AN-7.2: Question 8 - Image 1

The configuration shown in the exhibit is incorrect.
What must you change to allow this configuration to be successfully applied to FortiSIEM?

The Train factor must be 70% or greater.

Run Mode must be set to ML.

Only one AVG type field must be selected under Fields to use for Prediction.

The selection in Fields to use for Prediction and Field to Predict must match.

Correct Answer: B

Question 9 of 9

How does FortiSIEM update the incident table if a performance rule triggers repeatedly?

FortiSIEM changes the incident status to Repeated, and updates the Last Seen timestamp.

FortiSIEM updates the Incident Count value and Last Seen timestamp.

FortiSIEM generates a new incident based on the Rule Frequency value, and updates the First Seen and Last Seen timestamps.

FortiSIEM generates a new incident each time the rule triggers, and updates the First Seen and Last Seen timestamps.

Correct Answer: B