Fortinet FCP_FSM_AN-7.2 Exam Questions

Question 6 of 32

Refer to the exhibit.
Exam FCP_FSM_AN-7.2: Question 6 - Image 1

An analyst is trying to generate an incident with a title that includes the Source IP, Destination IP, User, and Destination Host Name. They are unable to add a Destination Host Name as an incident attribute.
What must be changed to allow the analyst to select Destination Host Name as an attribute?

The Destination Host Name must be selected as a Triggered Attribute.

The Destination Host Name must be set as an aggregate item in a subpattern.

The Destination Host Name must be added as an Event type in the FortiSIEM.

The Destination IP Event Attribute must be removed.

Correct Answer: A

Question 7 of 32

Refer to the exhibit.
Exam FCP_FSM_AN-7.2: Question 7 - Image 1

What will happen when a device being analyzed by the machine learning configuration shown in the exhibit has a consistently high memory utilization?

FortiSIEM will update the regression tables for memory utilization, and average sent and received bytes.

FortiSIEM will trigger an incident for high memory utilization.

FortiSIEM will lower the CPU utilization trigger requirement for CPU utilization.

FortiSIEM will update the model with a higher memory utilization average value.

Correct Answer: D

Question 8 of 32

Which two settings must you configure to allow FortiSIEM to apply tags to devices in FortiClient EMS? (Choose two.)

FortiEMS API credentials defined on FortiSIEM

Remediation script configured

ZTNA tags defined on FortiSIEM

FortiSIEM API credentials defined on FortiEMS

Correct Answer: A, D

Question 9 of 32

What are two required components of a rule? (Choose two.)

Exception policy

Subpattern

Detection Technology

Clear policy

Correct Answer: B, C

Question 10 of 32

Refer to the exhibit.
Exam FCP_FSM_AN-7.2: Question 10 - Image 1

If you group the events by User and Count attributes, how many results will FortiSIEM display?