FCP FCP FortiSIEM & Security Monitoring 2

Question 1

What is the purpose of FortiSIEM's 'Watch List' feature?

Accepted Answer

Tracking specific users, IPs, or devices for heightened monitoring and alerting

Answer

Watch Lists in FortiSIEM allow analysts to tag specific identities or assets for elevated scrutiny, ensuring any associated events receive higher priority.

Question 2

Which FortiSIEM feature maps detected incidents to MITRE ATT&CK tactics and techniques?

Accepted Answer

MITRE ATT&CK mapping in incident details

Answer

FortiSIEM can tag incidents with corresponding MITRE ATT&CK tactics and techniques, helping analysts understand attacker behavior within a structured framework.

Question 3

In a multi-tenant FortiSIEM deployment, how are different customer environments kept isolated?

Accepted Answer

Organizations (orgs) provide logical separation of devices, events, and policies per tenant

Answer

FortiSIEM uses Organizations (orgs) to logically isolate each tenant's devices, events, rules, and dashboards within a single shared deployment.

Question 4

What is the function of FortiSIEM's 'Real-Time Search'?

Accepted Answer

Querying incoming events live as they arrive without needing a stored log index

Answer

Real-Time Search in FortiSIEM lets analysts filter and examine events as they stream in, enabling immediate threat hunting without waiting for indexing.

Question 5

Which FortiSIEM protocol integration is commonly used to pull performance and availability metrics from network devices?

Accepted Answer

SNMP

Answer

FortiSIEM uses SNMP to poll network devices for performance counters, interface statistics, and availability data for infrastructure monitoring.

(FCP) Fortinet Certified Professional Security Operations Practice Test

(FCP) Fortinet Certified Professional Security Operations Practice Test

FCP FCP FortiSIEM & Security Monitoring 2