Fortinet NSE 7 - Security Operations 7.6 Architect - NSE7_SOC_AR-7.6 FREE EXAM DUMPS QUESTIONS & ANSWERS
Which two phases are part of the FortiSOAR incident handling process but are not phases in the NIST 800-61 Revision 2 model? Choose two answers.
Correct Answer: C,D
Vote an answer
Explanation: Only visible for FreeCram members. You can sign-up / login (it's free).
Refer to Exhibit:
You are tasked with reviewing a new FortiAnalyzer deployment in a network with multiple registered logging devices. There is only one FortiAnalyzer in the topology.
Which potential problem do you observe?
You are tasked with reviewing a new FortiAnalyzer deployment in a network with multiple registered logging devices. There is only one FortiAnalyzer in the topology.
Which potential problem do you observe?
Correct Answer: B
Vote an answer
Explanation: Only visible for FreeCram members. You can sign-up / login (it's free).
Refer to the exhibit.
You are trying to find traffic flows to destinations that are in Europe or Asia, for hosts in the local LAN segment. However, the query returns no results. Assume these logs exist on FortiSIEM.
Which three mistakes can you see in the query shown in the exhibit? (Choose three answers)
You are trying to find traffic flows to destinations that are in Europe or Asia, for hosts in the local LAN segment. However, the query returns no results. Assume these logs exist on FortiSIEM.
Which three mistakes can you see in the query shown in the exhibit? (Choose three answers)
Correct Answer: C,D,E
Vote an answer
Explanation: Only visible for FreeCram members. You can sign-up / login (it's free).
Refer to the exhibit.
You must configure the FortiGate connector to allow FortiSOAR to perform actions on a firewall. However, the connection fails. Which two configurations are required? (Choose two answers)
You must configure the FortiGate connector to allow FortiSOAR to perform actions on a firewall. However, the connection fails. Which two configurations are required? (Choose two answers)
Correct Answer: A,C
Vote an answer
Explanation: Only visible for FreeCram members. You can sign-up / login (it's free).
Refer to the exhibit.
The input of a FortiSIEM connector action is shown.
You want to create a playbook on FortiSOAR that allows you to accomplish the following:
Manually input an IP address.
Use the connector action in the exhibit to retrieve a device from the FortiSIEM configuration management database (CMDB) with that IP address.
Ask the SOC manager to review the information pulled from FortiSIEM about that device.
If the manager approves, an asset record is created.
Which combination and order of step operations fulfills the requirements with the fewest required playbook steps?
The input of a FortiSIEM connector action is shown.
You want to create a playbook on FortiSOAR that allows you to accomplish the following:
Manually input an IP address.
Use the connector action in the exhibit to retrieve a device from the FortiSIEM configuration management database (CMDB) with that IP address.
Ask the SOC manager to review the information pulled from FortiSIEM about that device.
If the manager approves, an asset record is created.
Which combination and order of step operations fulfills the requirements with the fewest required playbook steps?
Correct Answer: B
Vote an answer
Explanation: Only visible for FreeCram members. You can sign-up / login (it's free).
Review the following incident report:
Attackers leveraged a phishing email campaign targeting your employees.
The email likely impersonated a trusted source, such as the IT department, and requested login credentials.
An unsuspecting employee clicked a malicious link in the email, leading to the download and execution of a Remote Access Trojan (RAT).
The RAT provided the attackers with remote access and a foothold in the compromised system.
Which two MITRE ATT & CK tactics does this incident report capture? (Choose two.)
Attackers leveraged a phishing email campaign targeting your employees.
The email likely impersonated a trusted source, such as the IT department, and requested login credentials.
An unsuspecting employee clicked a malicious link in the email, leading to the download and execution of a Remote Access Trojan (RAT).
The RAT provided the attackers with remote access and a foothold in the compromised system.
Which two MITRE ATT & CK tactics does this incident report capture? (Choose two.)
Correct Answer: C,D
Vote an answer
Explanation: Only visible for FreeCram members. You can sign-up / login (it's free).
Match the FortiSIEM device type to its description. Select each FortiSIEM device type in the left column, hold and drag it to the blank space next to its corresponding description in the column on the right.
Correct Answer:
* Collector 2. Worker 3. Supervisor 4. Agent
* The FortiSIEM 7.3 architecture is built upon a distributed multi-tenant model consisting of several distinct functional roles to ensure scalability and performance:
* Supervisor: This is the primary management node in a FortiSIEM cluster. It hosts the Graphical User Interface (GUI), the Configuration Management Database (CMDB), and manages the overall system configurations, reporting, and dashboarding.
* Worker: These nodes are responsible for the heavy lifting of data processing. They execute real- time event correlation against the rules engine, perform historical search queries, and handle the analytics workload to ensure the Supervisor node is not overwhelmed.
* Collector: Collectors are typically deployed at remote sites or different network segments to offload log collection from the central cluster. They receive logs via Syslog, SNMP, or WMI, compress the data, and securely forward it to the Workers or Supervisor. They also perform performance monitoring of local devices.
* Agent: These are lightweight software components installed directly on endpoints (Windows
/Linux). Their primary role is to collect local endpoint logs, monitor file integrity (system changes), and track user activity that cannot be captured via traditional network-based logging.
When configuring an Ingest Bulk Feed playbook step, which two restrictions must you consider? Choose two answers.
Correct Answer: C,D
Vote an answer
Explanation: Only visible for FreeCram members. You can sign-up / login (it's free).
A partner organization recently suffered a distributed denial-of-service (DDoS) attack, but the adversary's identity and TTPs remain unknown. Your SOC has not received any relevant threat intelligence from the partner organization, but you are asked to determine whether similar activity could be happening in your environment. Which threat hunting action should you perform first? Choose one answer.
Correct Answer: D
Vote an answer
Explanation: Only visible for FreeCram members. You can sign-up / login (it's free).
Refer to the exhibits.
The DOS attack playbook is configured to create an incident when an event handler generates a denial-of-ser
/ice (DoS) attack event.
Why did the DOS attack playbook fail to execute?
The DOS attack playbook is configured to create an incident when an event handler generates a denial-of-ser
/ice (DoS) attack event.
Why did the DOS attack playbook fail to execute?
Correct Answer: C
Vote an answer
Explanation: Only visible for FreeCram members. You can sign-up / login (it's free).