Online Access Free FCP_FSM_AN-7.2 Practice Test

Refer to the exhibit.

A FortiSIEM device is receiving syslog events from a FortiGate firewall. The FortiSIEM analyst is trying to search the raw event logs for the last two hours that contain the keyword "udp".
However, they are getting no results from the search, which they know should be available.
Based on the filter shown in the exhibit, why are there no search results?

• A.The Time Range value should be set to Real-Time.
• B.The keyword is case sensitive. Instead of typing udp in the Value field, the analyst should type UDP.
• C.The analyst selected AND in the Next column. This is the wrong Boolean operator.
• D.The analyst selected = in the Operator column. That is the wrong operator.

Refer to the exhibit. What will FortiSIEM display if you apply the Group By and Display Fields configuration to a list of allowed firewall connections?

• A.A list of connections ordered by the number of unique connections started by each source IP address
• B.A list of connections between unique source and destination IP addresses
• C.A running count of connections, regardless of source or destination
• D.A list of connections ordered by destination IP address hit count

Refer to the exhibit. Which value would be saved as the Event Type attribute by the default FortiSIEM parser?

• A.sysUpTime
• B.diskUtil
• C.PHL_INFO
• D.PH_DEV_MON_SYS_UPTIME

When selecting multiple rules at once on FortiSIEM, what actions can you perform?

• A.You can only change the severity of multiple rules.
• B.You can only activate or deactivate multiple rules.
• C.You can change the severity of multiple rules, and activate or deactivate them.
• D.You can only view, edit, and activate a single rule at one time.

Refer to the exhibit. If you group the events by Reporting IP, Event Type, and User attributes, how many results will FortiSIEM display?

• A.Four
• B.Two
• C.Three
• D.Five