QUESTION 13
How can you empower SOC by deploying FortiSOAR? (Choose three.)

QUESTION 14
Which statement about EPS bursting is true?

QUESTION 15
What is Tactic in the MITRE ATT&CK framework?

QUESTION 16
From where does the rule engine load the baseline data values?

QUESTION 17
Which three processes are collector processes? (Choose three.)

QUESTION 18
How can you invoke an integration policy on FortiSIEM rules?

QUESTION 19
Which two statements about the maximum device limit on FortiSIEM are true? (Choose two.)

QUESTION 20
Refer to the exhibit.

An administrator wants to remediate the incident from FortiSIEM shown in the exhibit.
What option is available to the administrator?

QUESTION 21
Which of the following are two Tactics in the MITRE ATT&CK framework? (Choose two.)

QUESTION 22
Which syntax will register a collector to the supervisor?

QUESTION 23
Refer to the exhibit. Click on the calculator button.

The profile database contains CPU utilization values from day one. At midnight on the second day, the CPU utilization values from the daily database will be merged with the profile database.
In the profile database, in the Hour of Day column where 9 is the value, what will be the updated minimum, maximum, and average CPU utilization values?

QUESTION 24
Refer to the exhibit.

An administrator runs an analytic search for all FortiGate SSL VPN logon failures. The results are grouped by source IP, reporting IP, and user. The administrator wants to restrict the results to only those rows where the COUNT >= 3.
Which user would meet that condition?

QUESTION 25
Refer to the exhibit.

The window for this rule is 30 minutes.
What is this rule tracking?

QUESTION 26
Refer to the exhibit.

How long has the UEBA agent been operationally down?