Question 1

When you use a manual trigger to save user input as a variable, what is the correct Jinja expression to reference the variable? (Choose one answer)

Options :

A :

B :

C :

D :

Answer: A

Question 2

A customer wants FortiAnalyzer to run an automation stitch that executes a CLI command on FortiGate to block a predefined list of URLs, if a botnet command-and-control (C&C) server IP is detected. Which FortiAnalyzer feature must you use to start this automation process?

Options :

A : Playbook

B : Data selector

C : Event handler

D : Connector

Answer: C

Question 3

Refer to the exhibits.Assume that the traffic flows are identical, except for the destination IP address. There is only one FortiGatein network address translation (NAT) mode in this environment.Based on the exhibits, which two conclusions can you make about this FortiSIEM incident? (Choose twoanswers)

Options :

A : The client 10.200.3.219 is conducting active reconnaissance.

B : FortiGate is not routing the packets to the destination hosts.

C : The destination hosts are not responding.

D : FortiGate is blocking the return flows.

Answer: A,C

Question 4

Refer to the exhibit. You notice that the custom event handler you configured to detect SMTP reconnaissance activities is creating a large number of events. This is overwhelming your notification system. How can you fix this?

Options :

A : Increase the trigger count so that it identifies and reduces the count triggered by a particular group.

B : Disable the custom event handler because it is not working as expected.

C : Decrease the time range that the custom event handler covers during the attack.

D : Increase the log field value so that it looks for more unique field values when it creates the event.

Answer: A

Question 5

Refer to the exhibit. Assume that all devices in the FortiAnalyzer Fabric are shown in the image. Which two statements about the FortiAnalyzer Fabric deployment are true? (Choose two.)

Options :

A : FortiGate-B1 and FortiGate-B2 are in a Security Fabric.

B : There is no collector in the topology.

C : All FortiGate devices are directly registered to the supervisor.

D : FAZ-SiteA has two ADOMs enabled.

Answer: A,D