Fortinet NSE 7 - Security Operations 7.6 Architect - NSE7_SOC_AR-7.6 FREE EXAM DUMPS QUESTIONS & ANSWERS
Refer to the exhibit.
Which two options describe how the Update Asset and Identity Database playbook is configured? (Choose two.)
Which two options describe how the Update Asset and Identity Database playbook is configured? (Choose two.)
Correct Answer: A,D
Vote an answer
Explanation: Only visible for FreeCram members. You can sign-up / login (it's free).
Which two ways can you create an incident on FortiAnalyzer? (Choose two.)
Correct Answer: A,C
Vote an answer
Explanation: Only visible for FreeCram members. You can sign-up / login (it's free).
Your company is doing a security audit To pass the audit, you must take an inventory of all software and applications running on all Windows devices Which FortiAnalyzer connector must you use?
Correct Answer: B
Vote an answer
Explanation: Only visible for FreeCram members. You can sign-up / login (it's free).
Which FortiAnalyzer feature uses the SIEM database for advance log analytics and monitoring?
Correct Answer: B
Vote an answer
Explanation: Only visible for FreeCram members. You can sign-up / login (it's free).
Review the incident report. Shortly after being compromised, an infected host collected its own network configuration and connection details, then began sending low-volume connection attempts to multiple internal addresses to identify responding hosts. Which two MITRE ATT & CK techniques best describe this activity?
Choose two answers.
Choose two answers.
Correct Answer: C,D
Vote an answer
Explanation: Only visible for FreeCram members. You can sign-up / login (it's free).
Refer to the exhibit.
You created a subpattern to detect at least five failed login attempts from any single user and source IP address to the same network device. However, it is creating more incidents than you had anticipated.
What are the two mistakes in the incident subpattern rule configuration? (Choose two.) Exhibit: FortiSIEM Rule Configuration FortiSIEM failed login rule configuration
You created a subpattern to detect at least five failed login attempts from any single user and source IP address to the same network device. However, it is creating more incidents than you had anticipated.
What are the two mistakes in the incident subpattern rule configuration? (Choose two.) Exhibit: FortiSIEM Rule Configuration FortiSIEM failed login rule configuration
Correct Answer: A,C
Vote an answer
Explanation: Only visible for FreeCram members. You can sign-up / login (it's free).
When configuring a FortiAnalyzer to act as a collector device, which two steps must you perform? (Choose two.)
Correct Answer: A,B
Vote an answer
Explanation: Only visible for FreeCram members. You can sign-up / login (it's free).
Refer to the exhibit.
You configured a playbook named False Positive Close, and want to run it to verify if it works. However, when you click Execute and search for the playbook, you do not see it listed. Which two reasons could be the cause of the problem? (Choose two answers)
You configured a playbook named False Positive Close, and want to run it to verify if it works. However, when you click Execute and search for the playbook, you do not see it listed. Which two reasons could be the cause of the problem? (Choose two answers)
Correct Answer: A,B
Vote an answer
Explanation: Only visible for FreeCram members. You can sign-up / login (it's free).
Which three factors does the FortiSIEM rules engine use to determine the count when it evaluates the aggregate condition COUNT (Matched Events) on a specific subpattern? (Choose three answers)
Correct Answer: C,D,E
Vote an answer
Explanation: Only visible for FreeCram members. You can sign-up / login (it's free).
Refer to the exhibit.
You created a threat hunting playbook to perform a search query using the FortiSIEM connector. However, when you run the playbook, you do not see any output. Which step must you take first in your troubleshooting process?
You created a threat hunting playbook to perform a search query using the FortiSIEM connector. However, when you run the playbook, you do not see any output. Which step must you take first in your troubleshooting process?
Correct Answer: C
Vote an answer
Explanation: Only visible for FreeCram members. You can sign-up / login (it's free).