FCP-FSM-AN-7-2: Fortinet NSE 6 - FortiSIEM 7.2 AnalystDemo

Question

Refer to the exhibit.

Question Image

An analyst needs the displayed rule to trigger when three failed login attempts take place within three minutes. What values should be set for the condition time window and the aggregate count?

A Time window 180 seconds, aggregate count 3
B Time window 180 seconds, aggregate count 2
C Time window 90 seconds, aggregate count 3
D Time window 90 seconds, aggregate count 2

Explanation

Three minutes is 180 seconds. Because the aggregate condition uses a strict greater-than operator (COUNT(Matched Events) > value), a value of 2 causes the rule to trigger at a matched-event count of 3.

FCP-FSM-AN-7-2: Fortinet NSE 6 - FortiSIEM 7.2 AnalystDemo

AstroTutor

Notes

Readiness

QuestionQ2

Community Discussion