The correct answer is C. CMDB user group . In FortiSIEM, users and user groups are maintained as CMDB objects and can be referenced in analytics filters and rule logic. The FortiSIEM 7.4 User Guide table of contents explicitly includes CMDB management for users, viewing user information, adding users, editing or deleting users, performing operations on users, and working with user groups. This confirms that user groups are part of the FortiSIEM CMDB data model. The query shown in the exhibit uses the Analytics filter with the User attribute and the value Group: FortiSIEM Analysts . That syntax indicates that FortiSIEM is referencing a FortiSIEM-defined user group from CMDB, not an LDAP group directly and not an Active Directory group directly. LDAP and Active Directory can be used to discover or authenticate users, but once referenced as a FortiSIEM analytics group value, the object is a CMDB user group. FortiSIEM organization groups are tenant/organization constructs and are not the same as CMDB user groups.

The correct answer is C. SSL . FortiSIEM receives raw logs, processes them through parsers, normalizes the extracted fields, classifies the event, and stores the structured data. The Study Guide explains the FortiSIEM process flow: data is collected, processed by the parsing engine, normalized, classified, and then stored. It further states that normalization extracts individual fields from raw events and maps those fields to a common schema. The FortiSIEM 7.4 User Guide describes a parser as a file containing instructions for the parser module to convert a raw log into event attributes. In the exhibit, the raw FortiGate log includes values such as profiletype= " applist " , appcat= " Network.Service " , and app= " SSL " . The field that directly represents the application value is app= " SSL " . Therefore, the parser would use SSL to populate the normalized Application Name field. applist describes the profile type, Network.Service is the application category, and wan1 is the interface, not the application name.

The correct answer is Local Auto. The uploaded answer was right, but its explanation was sloppy because it incorrectly described Local mode as the most time-consuming mode. In FortiSIEM machine learning, Local Auto mode selects the best algorithm by evaluating multiple candidate algorithms. The User Guide states that in Local Auto mode, “FortiSIEM picks the best algorithm” and that the Max Run Time parameter limits how long the job can run; longer runtime can produce better results. That is why Local Auto can take the most time. Forecasting and Regression are task types, not run modes.