Fortinet Exam FCP_FSM_AN-7.2 Topic 2 Question 1 Discussion

Actual exam question for Fortinet's FCP_FSM_AN-7.2 exam

Question #: 1
Topic #: 2

Which analytics search can be used to apply a user and entity behavior analytics (UEBA) tag to an event for a failed login by the user JSmith?

AUser = smith

BUsername NOT END WITH jsmith

CUser IS jsmith

DUsername CONTAIN smit

Show Suggested Answer

Suggested Answer: C

The correct syntax to match an exact username in FortiSIEM analytics search is User IS jsmith. This ensures that the UEBA tag is applied only when the event is specifically tied to the user 'jsmith', which is required for accurate behavioral analytics.

by Wenona at Oct 06, 2025, 09:43 PM

Limited Time Offer

25%

Off

Get Premium FCP_FSM_AN-7.2 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Annmarie

5 days ago

C) User IS jsmith is the correct answer. This will apply the UEBA tag to the failed login event for the user JSmith.

upvoted 0 times

...

Jutta

11 days ago

Based on the options, it seems like option C "User IS jsmith" would be the best choice to apply a UEBA tag to the failed login event for user JSmith. The other options don't seem to directly target that specific user.

upvoted 0 times

...

Pearline

16 days ago

I'm a little confused by this question. What exactly is a UEBA tag and how does that relate to identifying a failed login by a specific user? I'd need to do some research on UEBA before I could feel confident answering this.

upvoted 0 times

...

Carry

21 days ago

Okay, let's see. I'm guessing option C is the right answer since it directly matches the user JSmith. The other options don't seem to specifically target that user. I'll mark C and move on.

upvoted 0 times

...

Merri

26 days ago

Hmm, this is a tricky one. I'm not super familiar with UEBA, but it seems like we need to find a way to identify the user JSmith based on the login failure. I'd probably try to narrow it down by looking at the username options.

upvoted 0 times

...

Harris

1 months ago

I think I'd start by looking at the options and trying to understand what a UEBA tag is and how it relates to a failed login. The question seems to be asking about how to identify the user JSmith specifically.

upvoted 0 times

...