Fortinet NSE 7 - Security Operations 7.6 Architect - NSE7_SOC_AR-7.6 Exam Practice Test
Refer to the exhibits.
You configured a custom event handler and an associated rule to generate events whenever FortiMail detects spam emails. However, you notice that the event handler is generating events for both spam emails and clean emails.
Which change must you make in the rule so that it detects only spam emails?
You configured a custom event handler and an associated rule to generate events whenever FortiMail detects spam emails. However, you notice that the event handler is generating events for both spam emails and clean emails.
Which change must you make in the rule so that it detects only spam emails?
Correct Answer: C
Vote an answer
Explanation: Only visible for Fast2test members. You can sign-up / login (it's free).
Which two statements accurately describe the Custom API Endpoint playbook trigger? Choose two answers.
Correct Answer: A,B
Vote an answer
Explanation: Only visible for Fast2test members. You can sign-up / login (it's free).
Review the incident report. Shortly after being compromised, an infected host collected its own network configuration and connection details, then began sending low-volume connection attempts to multiple internal addresses to identify responding hosts. Which two MITRE ATT & CK techniques best describe this activity?
Choose two answers.
Choose two answers.
Correct Answer: C,D
Vote an answer
Explanation: Only visible for Fast2test members. You can sign-up / login (it's free).
You want to use the queue and shift management feature to automatically assign newly created low-priority tasks to members of the L1 queue. However, you are unable to add the Tasks module to the Module Types list. What is the problem? Choose one answer.
Correct Answer: B
Vote an answer
Explanation: Only visible for Fast2test members. You can sign-up / login (it's free).
Which statement best describes the MITRE ATT & CK framework?
Correct Answer: D
Vote an answer
Refer to the exhibit.
Which two options describe how the Update Asset and Identity Database playbook is configured? (Choose two.)
Which two options describe how the Update Asset and Identity Database playbook is configured? (Choose two.)
Correct Answer: B,C
Vote an answer
Explanation: Only visible for Fast2test members. You can sign-up / login (it's free).
When does FortiAnalyzer generate an event?
Correct Answer: C
Vote an answer
Explanation: Only visible for Fast2test members. You can sign-up / login (it's free).
Refer to Exhibits:
You configured the FortiGate connector on FortiSOAR. You want to allow FortiSOAR 10.200.200.160 to perform actions on FortiGate 172.16.200.1 . However, the connection attempt fails. Assume that the FortiGate connector is configured correctly on the FortiSOAR side.
Which two configurations are required on FortiGate? Choose two answers.
You configured the FortiGate connector on FortiSOAR. You want to allow FortiSOAR 10.200.200.160 to perform actions on FortiGate 172.16.200.1 . However, the connection attempt fails. Assume that the FortiGate connector is configured correctly on the FortiSOAR side.
Which two configurations are required on FortiGate? Choose two answers.
Correct Answer: B,D
Vote an answer
Explanation: Only visible for Fast2test members. You can sign-up / login (it's free).
Refer to Exhibit:
A SOC analyst is designing a playbook to filter for a high severity event and attach the event information to an incident.
Which local connector action must the analyst use in this scenario?
A SOC analyst is designing a playbook to filter for a high severity event and attach the event information to an incident.
Which local connector action must the analyst use in this scenario?
Correct Answer: D
Vote an answer
Explanation: Only visible for Fast2test members. You can sign-up / login (it's free).
Review the following incident report:
Attackers leveraged a phishing email campaign targeting your employees.
The email likely impersonated a trusted source, such as the IT department, and requested login credentials.
An unsuspecting employee clicked a malicious link in the email, leading to the download and execution of a Remote Access Trojan (RAT).
The RAT provided the attackers with remote access and a foothold in the compromised system.
Which two MITRE ATT & CK tactics does this incident report capture? (Choose two.)
Attackers leveraged a phishing email campaign targeting your employees.
The email likely impersonated a trusted source, such as the IT department, and requested login credentials.
An unsuspecting employee clicked a malicious link in the email, leading to the download and execution of a Remote Access Trojan (RAT).
The RAT provided the attackers with remote access and a foothold in the compromised system.
Which two MITRE ATT & CK tactics does this incident report capture? (Choose two.)
Correct Answer: B,C
Vote an answer
Explanation: Only visible for Fast2test members. You can sign-up / login (it's free).