FCP FCP FortiSIEM & Security Monitoring

Question 1

What is the primary function of FortiSIEM in a security operations environment?

Accepted Answer

Unified security information and event management combining log correlation, analytics, and compliance

Answer

Endpoint antivirus scanning and remediation

Answer

WAN optimization and traffic acceleration

Answer

Firewall policy deployment across branches

Question 2

In FortiSIEM, what is a 'Rule' used for?

Accepted Answer

Defining correlation logic that triggers incidents when event patterns are matched

Answer

Configuring firewall access policies

Answer

Scheduling vulnerability scans

Answer

Creating network diagrams

Question 3

Which FortiSIEM component is responsible for parsing raw log data into structured event attributes?

Accepted Answer

Event parser

Answer

Collector agent

Answer

Incident engine

Answer

CMDB scanner

Question 4

What is the role of the FortiSIEM CMDB?

Accepted Answer

Maintaining an inventory of discovered devices, their attributes, and relationships

Answer

Storing encrypted credentials for LDAP authentication

Answer

Caching DNS resolutions for faster event lookup

Answer

Managing SSL VPN user sessions

Question 5

Which FortiSIEM deployment component is typically placed in remote sites to collect and forward logs to the supervisor?

Accepted Answer

FortiSIEM Collector

Answer

FortiSIEM Worker

Answer

FortiSIEM Supervisor

Answer

FortiSIEM Agent

Question 6

In FortiSIEM, what does 'baseline deviation' detection help identify?

Accepted Answer

Anomalous user or device behavior that differs significantly from established normal patterns

Answer

Devices that are missing security patches

Answer

Firewall rules that overlap or conflict

Answer

SSL certificates nearing expiration