Fortinet FCP_FSM_AN-7.2 Exam - Topic 2 Question 1 Discussion

Actual exam question for Fortinet's FCP_FSM_AN-7.2 exam

Question #: 1
Topic #: 2

Which analytics search can be used to apply a user and entity behavior analytics (UEBA) tag to an event for a failed login by the user JSmith?

AUser = smith

BUsername NOT END WITH jsmith

CUser IS jsmith

DUsername CONTAIN smit

Show Suggested Answer

Suggested Answer: C

The correct syntax to match an exact username in FortiSIEM analytics search is User IS jsmith. This ensures that the UEBA tag is applied only when the event is specifically tied to the user 'jsmith', which is required for accurate behavioral analytics.

by Wenona at Oct 06, 2025, 08:43 PM

Limited Time Offer

25%

Off

Get Premium FCP_FSM_AN-7.2 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Celestina

17 days ago

C aligns perfectly with the requirement.

upvoted 0 times

...

Gertude

22 days ago

I feel confident about C too. It’s precise.

upvoted 0 times

...

Maryrose

27 days ago

C is the best option. UEBA needs exact matches.

upvoted 0 times

...

Cecilia

2 months ago

D is misleading. It doesn't specifically target JSmith.

upvoted 0 times

...

Val

2 months ago

B is definitely wrong. It excludes JSmith.

upvoted 0 times

...

Sabina

2 months ago

A is too vague. It could apply to anyone named Smith.

upvoted 0 times

...

Dong

2 months ago

I thought it would be more complicated than this!

upvoted 0 times

...

Odette

2 months ago

Wait, are we sure about that? Seems too simple.

upvoted 0 times

...

Corazon

2 months ago

No way, it's definitely C) User IS jsmith!

upvoted 0 times

...

Sanda

3 months ago

I think A) User = smith could work too.

upvoted 0 times

...

Rebecka

3 months ago

C) User IS jsmith is the right choice!

upvoted 0 times

...

Aleta

3 months ago

I’m confused about the difference between "IS" and "CONTAIN." I feel like I’ve seen both in practice questions, but I can't recall which is more accurate for this scenario.

upvoted 0 times

...

Royal

3 months ago

I’m leaning towards C as well, but I wonder if A could also be correct if it’s just looking for a partial match.

upvoted 0 times

...

Audra

3 months ago

I think the answer might be C) User IS jsmith, but I'm not completely sure if the case sensitivity matters.

upvoted 0 times

...

Solange

3 months ago

Haha, I bet JSmith is regretting that password choice right about now. Time to update that security!

upvoted 0 times

...

Leslie

4 months ago

Agreed, C makes sense. Clear and straightforward.

upvoted 0 times

...

William

4 months ago

I think C is the right choice. It directly matches the user.

upvoted 0 times

...

Carla

4 months ago

I remember a similar question where we had to identify users based on their usernames. I feel like "NOT END WITH" could be a trick option here.

upvoted 0 times

...

Genevive

5 months ago

B) Username NOT END WITH jsmith is an interesting approach, but it won't work for this specific case.

upvoted 0 times

...

Melita

5 months ago

A) User = smith is close, but it doesn't quite match the username format. We need to use the full username, JSmith.

upvoted 0 times

...

Gwen

5 months ago

D) Username CONTAIN smit is a good try, but it's a bit too broad. We want to specifically target the user JSmith.

upvoted 0 times

...

Annmarie

5 months ago

C) User IS jsmith is the correct answer. This will apply the UEBA tag to the failed login event for the user JSmith.

upvoted 0 times

...

Jutta

5 months ago

Based on the options, it seems like option C "User IS jsmith" would be the best choice to apply a UEBA tag to the failed login event for user JSmith. The other options don't seem to directly target that specific user.

upvoted 0 times

...

Pearline

6 months ago

I'm a little confused by this question. What exactly is a UEBA tag and how does that relate to identifying a failed login by a specific user? I'd need to do some research on UEBA before I could feel confident answering this.

upvoted 0 times

...

Carry

6 months ago

Okay, let's see. I'm guessing option C is the right answer since it directly matches the user JSmith. The other options don't seem to specifically target that user. I'll mark C and move on.

upvoted 0 times

...

Merri

6 months ago

Hmm, this is a tricky one. I'm not super familiar with UEBA, but it seems like we need to find a way to identify the user JSmith based on the login failure. I'd probably try to narrow it down by looking at the username options.

upvoted 0 times

...

Harris

6 months ago

I think I'd start by looking at the options and trying to understand what a UEBA tag is and how it relates to a failed login. The question seems to be asking about how to identify the user JSmith specifically.

upvoted 0 times