FCP FCP FortiSIEM & Security Monitoring

Question 1

What is the primary function of FortiSIEM in a security operations environment?

Accepted Answer

Unified security information and event management combining log correlation, analytics, and compliance

Answer

FortiSIEM provides a unified SIEM platform that ingests, correlates, and analyzes logs and events from diverse IT and security sources for threat detection and compliance.

Question 2

In FortiSIEM, what is a 'Rule' used for?

Accepted Answer

Defining correlation logic that triggers incidents when event patterns are matched

Answer

Rules in FortiSIEM define event correlation conditions — when logs match the specified pattern, FortiSIEM automatically generates an incident.

Question 3

Which FortiSIEM component is responsible for parsing raw log data into structured event attributes?

Accepted Answer

Event parser

Answer

The event parser in FortiSIEM processes raw log strings and extracts structured fields such as source IP, user, and action for downstream correlation.

Question 4

What is the role of the FortiSIEM CMDB?

Accepted Answer

Maintaining an inventory of discovered devices, their attributes, and relationships

Answer

The FortiSIEM CMDB (Configuration Management Database) automatically discovers and catalogs network assets, enabling context-aware event correlation.

Question 5

Which FortiSIEM deployment component is typically placed in remote sites to collect and forward logs to the supervisor?

Accepted Answer

FortiSIEM Collector

Answer

The FortiSIEM Collector is deployed at remote locations to aggregate logs from local devices and forward them to the central Supervisor for analysis.

(FCP) Fortinet Certified Professional Security Operations Practice Test

(FCP) Fortinet Certified Professional Security Operations Practice Test

FCP FCP FortiSIEM & Security Monitoring