Exit NSE5_FSM-5.2 Fortinet NSE 5 - FortiSIEM 5.2
Question 5 of 5
0% complete
Q5 Single choice

Refer to the exhibit.

A FortiSlEM administrator wants to group some attributes for a report, but is not able to do so successfully.

As shown in the exhibit, why are some of the fields highlighted in red?

  • A

    The Event Receive Time attribute is not available for logs.

  • B

    The attribute COUNT(Matched event) is an invalid expression.

  • C

    Unique attributes cannot be grouped.

  • D

    No RAW Event Log attribute is available for devices.

Previous Save & finish