Question 1

Refer to the exhibit.A FortiSIEM analyst is investigating an issue by examining events to two destination IP addresses. However, the analyst is not getting any results from the search. Based on the selected filter shown in the exhibit, why is the search returning no results?

Options :

A : Parentheses are missing between the two items.

B : The wrong Boolean operator is selected in the Next column.

C : The wrong option is selected in the Operator column.

D : An invalid IP address is typed in the Value column.

Answer: B

Question 2

Which information can FortiSIEM retrieve from FortiClient EMS through an API connection?

Options :

A : Host software versions

B : FortiSIEM license

C : Host login credentials

D : ZTNA tags

Answer: D

Question 3

Which statement about thresholds is true?

Options :

A : FortiSIEM uses fixed, hardcoded global and device thresholds for all performance metrics.

B : FortiSIEM uses only device thresholds for security metrics.

C : FortiSIEM uses global and per-device thresholds for performance metrics.

D : FortiSIEM uses only global thresholds for performance metrics.

Answer: C

Question 4

Refer to the exhibit.Which two actions can you select in an automation policy to trigger an API call to block an IP address on a FortiGate? (Choose two.)

Options :

A : Open Remedy ticket using the configuration set in Analytics.

B : Send Email/SMS/Webhook to the target users.

C : Invoke an Integration Policy.

D : Run Remediation/Script.

E : Run Playbook on Incident Trigger.

Answer: D,E