FCP_FSM_AN-7.2: FCP - FortiSIEM 7.2 Analyst Rule Practice Questions

What are two required components of a rule? (Choose two.)

Select 2 answers.

• AA. Exception policy
• BB. Subpattern
• CC. Detection Technology
• DD. Clear policy

Refer to the exhibit. Which section contains the subpattern configuration that determines how many matching events are needed to trigger the rule?

• AA. Aggregate
• BB. Group By
• CC. Actions
• DD. Filters

Refer to the exhibit. If a rule containing the automation policy shown in the exhibit triggers, what will happen?

• AA. Associated source IP addresses will be blocked on devices in the Aviation organization.
• BB. Associated source IP addresses will be blocked on all FortiGate firewalls.
• CC. Associated source IP addresses will be blocked on devices in the Network CMDB group.
• DD. Associated source IP addresses will be blocked on two FortiGate firewalls.