NSE7_SOC_AR-7.6 Exam Questions

Which statement describes automation stitch integration between FortiGate and FortiAnalyzer?

Which three end user logs does FortiAnalyzer use to identify possible IOC compromised hosts? (Choose three.)

Which role does a threat hunter play within a SOC?

According to the National Institute of Standards and Technology (NIST) cybersecurity framework, incident handling activities can be divided into phases. In which incident handling...

Which FortiAnalyzer connector can you use to run automation stitches9

Refer to the exhibits. What can you conclude from analyzing the data using the threat hunting module?

Refer to the exhibits. You configured a spearphishing event handler and the associated rule. However. FortiAnalyzer did not generate an event. When you check the FortiAnalyzer log...

While monitoring your network, you discover that one FortiGate device is sending significantly more logs to FortiAnalyzer than all of the other FortiGate devices in the topology. A...

Refer to the Exhibit. An analyst wants to create an incident and generate a report whenever FortiAnalyzer generates a malicious attachment event based on FortiSandbox analysis. The...

Your company is doing a security audit. To pass the audit, you must take an inventory of all software and applications running on all Windows devices. Which FortiAnalyzer connector...

Which two playbook triggers enable the use of trigger events in later tasks as trigger variables? (Choose two.)

Refer to the exhibit. You notice that the custom event handler you configured to detect SMTP reconnaissance activities is creating a large number of events. This is overwhelming yo...

When configuring a FortiAnalyzer to act as a collector device, which two steps must you perform? (Choose two.)

Refer to the exhibit. You are tasked with reviewing a new FortiAnalyzer deployment in a network with multiple registered logging devices. There is only one FortiAnalyzer in the top...

Refer to the exhibit, which shows the partial output of the MITRE ATT&CK Enterprise matrix on FortiAnalyzer. Which two statements are true? (Choose two.)

Refer to Exhibit. A SOC analyst is creating the Malicious File Detected playbook to run when FortiAnalyzer generates a malicious file event. The playbook must also update the incid...

Refer to the exhibits. The DOS attack playbook is configured to create an incident when an event handler generates a denial-of-ser/ice (DoS) attack event. Why did the DOS attack pl...

Which two statements about the FortiAnalyzer Fabric topology are true? (Choose two.)

Review the following incident report: The RAT provided the attackers with remote access and a foothold in the compromised system. Which two MITRE ATT&CK tactics does this incident...

Refer to Exhibit. A SOC analyst is designing a playbook to filter for a high severity event and attach the event information to an incident. Which local connector action must the a...

Refer to the exhibit. Which two options describe how the Update Asset and Identity Database playbook is configured? (Choose two.)

Refer to the exhibits. The Malicious File Detect playbook is configured to create an incident when an event handler generates a malicious file detection event. Why did the Maliciou...

Refer to the exhibit. Assume that all devices in the FortiAnalyzer Fabric are shown in the image. Which two statements about the FortiAnalyzer Fabric deployment are true? (Choose t...

Which two types of variables can you use in playbook tasks? (Choose two.)

Refer to the exhibits. The FortiMail Sender Blocklist playbook is configured to take manual input and add those entries to the FortiMail abc. com domain-level block list. The playb...

Which two ways can you create an incident on FortiAnalyzer? (Choose two.)

Which statement best describes the MITRE ATT&CK framework?

Refer to the exhibits. Which observation about this FortiAnalyzer Fabric deployment architecture is true?

Which FortiAnalyzer feature uses the SIEM database for advance log analytics and monitoring?

Refer to the exhibits. You configured a custom event handler and an associated rule to generate events whenever FortiMail detects spam emails. However, you notice that the event ha...

When does FortiAnalyzer generate an event?

A customer wants FortiAnalyzer to run an automation stitch that executes a CLI command on FortiGate to block a predefined list of URLs, if a botnet command-and-control (C&C) server...

Which National Institute of Standards and Technology (NIST) incident handling phase involves removing malware and persistence mechanisms from a compromised host?

You are not able to view any incidents or events on FortiAnalyzer. What is the cause of this issue?

Refer to the exhibits. The Quarantine Endpoint by EMS playbook execution failed. What can you conclude from reviewing the playbook tasks and raw logs?

You are tasked with configuring automation to quarantine infected endpoints. Which two Fortinet SOC components can work together to fulfill this task? (Choose two.)

Which two assets are available with the outbreak alert licensed feature on FortiAnalyzer? (Choose two.)

Which trigger type requires manual input to run a playbook?

Review the following incident report. Which two MITRE ATT&CK tactics are captured in this report? (Choose two.)

You are managing 10 FortiAnalyzer devices in a FortiAnalyzer Fabric. In this scenario, what is a benefit of configuring a Fabric group?

Refer to the exhibits. Which connector and action on FortiAnalyzer can you use to add the entries show in the exhibits? Domain List: Domain abc.com:

Which connector on FortiAnalyzer is responsible for looking up indicators to get threat intelligence?

Review the incident report. An attacker identified employee names, roles, and email patterns from public press releases, which were then used to craft tailored emails. The emails w...

Which three are threat hunting activities? (Choose three answers)

Refer to the exhibit. How do you add a piece of evidence to the Action Logs Marked As Evidence area? (Choose one answer)

Refer to the exhibits. Assume that the traffic flows are identical, except for the destination IP address. There is only one FortiGate in network address translation (NAT) mode in...

When you use a manual trigger to save user input as a variable, what is the correct Jinja expression to reference the variable? (Choose one answer)

Based on the Pyramid of Pain model, which two statements accurately describe the value of an indicator and how difficult it is for an adversary to change? (Choose two answers)

Refer to the exhibits. You have a playbook that, depending on whether an analyst deems the alert to be a true positive, could reference a child playbook. You need to pass variables...

Which three factors does the FortiSIEM rules engine use to determine the count when it evaluates the aggregate condition COUNT (Matched Events) on a specific subpattern? (Choose th...