NSE7_SOC_AR-7.6 — Fortinet NSE 7 - Security Operations 7.6 Architect All 46 questions & answers on one page · harvested from ExamTopics discussion threads, Google search + Fortinet official docs · 34 exhibit images

DRAG DROP - Refer to the exhibits. You have a playbook that, depending on whether an analyst deems the alert to be a true positive, could reference a child playbook. You need to pass variables from the parent playbook to the child playbook. Place the steps needed to accomplish this in the correct order. Select the step in the left column, hold and drag it to a blank position on the right. Place the three correct steps in order, placing the first step in the first position at the top of the column. Once you place a step, you can move it again if you want to change your answer before moving to the next question. You need to drop three steps in the work area. Select and drag the screen divider to change the viewable area of the source and work areas.

Refer to the exhibit. You created a new playbook and executed it as a test. However, it failed to run. You want to investigate, but you do not see details about the error. What is the reason for the lack of details?

Refer to the exhibit. You configured a playbook named False Positive Close, and want to run it to verify if it works. However, when you click Execute and search for the playbook, you do not see it listed. Which two reasons could be the cause of the problem? (Choose two.)

Refer to the exhibit. You created a threat hunting playbook to perform a search query using the FortiSIEM connector. However, when you run the playbook, you do not see any output. Which step must you take first in your troubleshooting process?

Refer to the exhibit. A list of FortiSIEM connector actions is shown. You want to create a playbook on FortiSOAR that allows you to accomplish the following: Manually input a range of IP addresses. Use the connector action in the exhibit to retrieve a list of devices from the FortiSIEM configuration management database (CMDB) within that IP address range. For each returned result, create an asset record based on the IP address of the device. Which combination and order of step operations fulfills the requirements with the fewest required playbook steps?

Refer to the exhibit. The input of a FortiSIEM connector action is shown. You want to create a playbook on FortiSOAR that allows you to accomplish the following: 1. Manually input an IP address. 2. Use the connector action in the exhibit to retrieve a device from the FortiSIEM configuration management database (CMDB) with that IP address. 3. Ask the SOC manager to review the information pulled from FortiSIEM about that device. 4. If the manager approves, an asset record is created. Which combination and order of step operations fulfills the requirements with the fewest required playbook steps?

Refer to the exhibit. The global playbook logging level is set to DEBUG. What is the primary risk of leaving this setting enabled?

DRAG DROP - Refer to the exhibit. What is the correct Jinja expression to filter the results to show only the MD5 hash values? {{ [slot 1]|[slot 2][slot 3].[slot 4] }} Select the jinja expression in the left column, hold and drag it to a blank position on the right. Place the four correct steps in order, placing the first step in the first slot. Once you place an expression, you can move it again if you want to change your answer before moving to the next question. You need to drop four jinja expressions in the work area. Select and drag the screen divider to change the viewable area of the source and work areas.

Which three statements accurately describe step utilities in a playbook step? (Choose three.)

What are three capabilities of the built-in FortiSOAR Jinja editor? (Choose three.)

DRAG DROP - Refer to the exhibit. What is the correct Jinja expression to filter the results to show only the MD5 hash values? {{ [slot 1]|[slot 2][slot 3].[slot 4] ") }} Select the Jinja expression in the left column, hold and drag it to a blank position on the right. Place the four correct steps in order, placing the first step in the first slot. Once you place an expression, you can move it again if you want to change your answer before moving to the next question. You need to drop four Jinja expressions in the work area. Select and drag the screen divider to change the viewable area of the source and work areas.

DRAG DROP - Using the default data ingestion wizard in FortiSOAR, place the incident handling workflow from FortiSIEM to FortiSOAR in the correct sequence. Select each workflow component in the left column, hold and drag it to a blank position on the right. Place the four correct workflow components in order, placing the first step in the first position at the top of the column. Once you place a step, you can move it again if you want to change your answer before moving to the next question. You need to drop four workflow components in the work area. Select and drag the screen divider to change the viewable area of the source and work areas.

Refer to the exhibits. You configured the FortiSIEM connector on FortiSOAR. However, when you try to save the configuration, you see the error shown in the exhibit. What are two possible causes? (Choose two.)

You wish to use FortiAI to help you design playbooks. Which two configurations on FortiSOAR are required? (Choose two.)

Refer to the exhibits. You configured the FortiGate connector on FortiSOAR. You want to allow FortiSOAR (10.200.200.160) to perform actions on FortiGate (172.16.200.1). However, the connection attempt fails. Assume that the FortiGate connector is configured correctly on the FortiSOAR side. Which two configurations are required on FortiGate? (Choose two.)

You created a war room and want to run a connector action to look up the reputation of a domain. Then, you need to save the output for your team to review. However, there is a lot of output, and you want to limit the amount of information attached to the war room. How do you accomplish this?

Refer to the exhibit. Based on the configuration shown in the exhibit, what are two misconfigurations? (Choose two.)

Which three factors does the FortiSIEM rules engine use to determine the count when it evaluates the aggregate condition COUNT (Matched Events) on a specific subpattern? (Choose three.)

Refer to the exhibit. What are the two mistakes in the incident subpattern rule configuration? (Choose two.)

Refer to the exhibit. You created a subpattern to detect at least five failed login attempts from any single user and source IP address to the same network device. However, it is creating more incidents than you had anticipated. What are the two mistakes in the incident subpattern rule configuration? (Choose two.)

You are configuring a new FortiSIEM rule to trigger incidents based on receiving a number of either Fortigate-Traffic-Violation OR Fortigate-Traffic-Denied event types. You could use a single subpattern for this, but you decided to create two separate subpatterns, one for each event type, and correlate them using the OR operator. Which two benefits does this approach provide? (Choose two.)

You are using FortiSIEM analytics to reference the configuration management database (CMDB) event type categories with the following requirements: Attribute: Event Type - Value: Group: Logon Success - Which operator must you use for the analytics search?

Refer to the exhibit. You are trying to find traffic flows to destinations that are in Europe or Asia, for hosts in the local LAN segment. However, the query returns no results. Assume these logs exist on FortiSIEM. Which three mistakes can you see in the query shown in the exhibit? (Choose three.)

Refer to the exhibits. You are searching for permitted traffic to public destination IP addresses outside of North America. Your investigation shows that one local computer is communicating with destination IP addresses that fit the criteria. However, you also notice that some of those IP addresses are duplicates, and you must aggregate the results. Which three steps do you need to use to configure the Group By and Display Fields window to show only aggregated results? (Choose three.)

You need to create a nested query in FortiSIEM that satisfies the following conditions: 1. Find all devices discovered by any FortiSIEM Windows Agent 2. From those devices, identify those that have generated Windows Login Failure events Which two query components should be used for this nested query? (Choose two.)

A large enterprise FortiSIEM deployment is experiencing delays in log correlation and analytics. Which architectural adjustment is most appropriate?

Based on the Pyramid of Pain model, which two statements accurately describe the value of an indicator and how it is for an adversary to change? (Choose two.)

Which three are threat hunting activities? (Choose three.)

An analyst prioritizes blocking IP addresses and domains from every phishing campaign. Based on the Pyramid of Pain model, which two statements accurately describe this approach? (Choose two.)

Which two statements best reflect the relationship between threat hunting and incident response in a mature SOC? (Choose two.)

Refer to the exhibit. You are reviewing the Triggering Events page for a FortiSIEM incident. You want to remove the Reporting IP column because you have only one firewall in the topology. How do you accomplish this?

Refer to the exhibit. You are investigating an open incident and want to add records from the Tickets module, a custom module, to the visual correlation widget. Assume there are already linked ticket records to the incident. How do you accomplish this?

Refer to the exhibit. A compromised PC establishes an SSH connection to an engineering build server, which then relays HTTPS traffic to reach servers that would otherwise have blocked access from the LAN. Which technique is used for this attack?

Refer to the exhibits. Assume that the traffic flows are identical, except for the destination IP address. There is only one FortiGate in network address translation (NAT) mode in this environment. Based on the exhibits, which two conclusions can you make about this FortiSIEM incident? (Choose two.)

Review the incident report. A fake HR login page was sent to several employees through email. The page copied the company’s branding and captured usernames and passwords. The attacker later used the stolen credentials to sign in through the company's web VPN portal. Which two MITRE ATTACK tactics best characterize this report? (Choose two.)

Refer to this partial incident output: Which conclusion can you make about this incident?

Refer to the exhibit. A compromised PC establishes an SSH connection to an engineering build server, which then relays HTTPS traffic to reach servers that would otherwise have blocked access from the LAN. Assume the LAN to Engineering and Engineering to IT network flows are allowed by design. Which configuration would prevent this attack vector?

Refer to the exhibits. How is the investigation and remediation output generated on FortiSIEM?

You configured a new module named Users. Next, you want to configure a playbook that creates users from ingested data. When new records are created, you want to ensure that duplicate users do not overwrite existing user records and their fields. However, you also want the playbook to continue running even if duplicates are encountered so that any non-duplicate records are still created. Which two actions fulfill the requirements? (Choose two.)

You configured a queue called L1 Analysts, and generated shifts to cover morning, evenings, and overnight shifts, with two members covering each shift. However, you noticed that all members of the queue are assigned ingested alerts in a round-robin fashion, instead of only users who are currently on shift. What is the problem?

You want to use the queue and shift management feature to automatically assign newly created low priority tasks to members of the L1 queue. However, you are unable to add the Tasks module to the Module Types list. What is the problem?

You are designing a FortiSOAR hybrid multi-tenant deployment. The architecture must support remote tenant execution and automation inside segmented networks. Which three elements are true for this design? (Choose three.)

Refer to the exhibit. Which method most effectively reduces the attack surface of this organization?

A FortiSOAR playbook includes a Wait step that is configured to pause execution after initiating a reputation lookup on an indicator. Which two configurations of the Wait step are valid? (Choose two.)

A partner organization recently suffered a distributed denial of service (DDoS) attack, but the adversary’s identity and TTPs remain unknown. Your SOC has not received any relevant threat intelligence from the partner organization, but you are asked to determine whether similar activity could be happening in your environment. Which threat hunting action should you perform first?