Curious about Actual Fortinet Certified Professional (FCP_FSM_AN-7.2) Exam Questions?

Correct : A

The fields are highlighted in red because unique values such as Event Receive Time and Raw Event Log cannot be used in group-by operations. Grouping requires aggregatable or consistent values across events, while these fields are unique to each event, making them incompatible for grouping.

Correct : B

Grouping by User, Source IP, and Count means that each unique combination of those three attributes will be treated as a separate result. In the table, all six rows have distinct combinations of User, Source IP, and Count - so FortiSIEM will display 6 results.

Correct : C

The Incident Status shows 'Auto Cleared', and the Cleared Reason states: 'Rule has not been triggered for 20 minutes.' This indicates that the incident was automatically cleared by the rule logic after a defined period of inactivity.

Correct : A

The Aggregate section contains the condition COUNT(Matched Events) >= 1, which defines how many events must match the filter criteria for the rule to trigger. This is the subpattern configuration that determines the event threshold.

Correct : C

FortiSIEM evaluates performance metrics against both global thresholds, which apply system-wide, and per-device thresholds, which can be customized for individual devices. This dual approach allows flexibility in monitoring while ensuring consistent baseline alerting.