fortinet-nse7_soc_ar-76_260430_095411(1)...

更新时间：试题数量：购买人数：提供作者：

有效期：个月

章节介绍：共有个章节

收藏

我的练习

我的错题
(0道)

我的收藏
(0道)

我的斩题
(0道)

我的笔记
(0道)

专项练习

顺序练习 练习进度 0 / 0

随机练习 自定义设置练习量

模拟考试 仿真模拟

题型练习 按题型分类练习

易错题 精选高频易错题

学习资料 考试学习相关信息

搜索

题库预览

Refer to Exhibit: A SOC analyst is creating the Malicious File Detected playbook to run when FortiAnalyzer generates a malicious file event. The playbook must also update the incident with the malicious file event data. What must the next task in this playbook be?

Refer to Exhibit: You are tasked with reviewing a new FortiAnalyzer deployment in a network with multiple registered logging devices. There is only one FortiAnalyzer in the topology. Which potential problem do you observe?

Refer to the exhibits. You configured a spearphishing event handler and the associated rule. However. FortiAnalyzer did not generate an event. When you check the FortiAnalyzer log viewer, you confirm that FortiSandbox forwarded the appropriate logs, as shown in the raw log exhibit. What configuration must you change on FortiAnalyzer in order for FortiAnalyzer to generate an event?

Refer to the exhibits. Investigation Actions: 1. Identify and Isolate Affected Systems: Begin by identifying the systems associated with the incident, specifically those linked to the IP addresses FortiGate-ISFW,FortiGate-NGFW, 10.200.200.254, and 100.64.2.21. Isolate these systems to prevent further data exfiltration. 2. Analyze Network Traffic: Examine network logs to trace the data flow and identify any unusual patterns or unauthorized data transfers. Focus on traffic related to the technique "Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol" (T1048.003). 3. Review Security Alerts and Logs: Check security alerts and logs from the incident reporting device and other security tools to gather more context on the exfiltration attempt. 4. Conduct a Forensic Analysis: Perform a forensic analysis on the affected systems to uncover any malware or unauthorized access points that facilitated the exfiltration. 5. Assess Data Impact: Determine the type and volume of data exfiltrated to assess the potential impact on the organization. 6. Implement Mitigation Measures: Based on findings, apply necessary security patches, update firewall rules, and enhance monitoring to prevent future incidents. Remediation Actions: 1. Immediate Containment: Isolate the affected systems, including the devices with IPs FortiGate-ISFW,FortiGate-NGFW and 10.200.200.254, to prevent the data exfiltration. Disconnect these systems from the network to halt any ongoing unauthorized data transfers. 2. Incident Analysis: Conduct a thorough investigation to understand the scope and impact of the exfiltration. Analyze logs and network traffic to identify the data accessed and the method used for exfiltration. 3. Patch and Update: Ensure all systems, especially those involved in the incident, are updated with the latest security patches to close any vulnerabilities that may have been exploited. 4. Enhance Monitoring: Implement enhanced monitoring and alerting for unusual data transfer activities, particularly focusing on non-standard protocols that may be used for exfiltration. 5. User Training: Conduct cybersecurity awareness training for employees to recognize and report suspicious activities, emphasizing the importance of protection. 6. Review and Update Security Policies: Reassess and update security policies and procedures to address any gaps identified during the incident analysis. How is the investigation and remediation output generated on FortiSIEM? (Choose one answer)

Refer to the exhibits. The Malicious File Detect playbook is configured to create an incident when an event handler generates a malicious file detection event. Why did the Malicious File Detect playbook execution fail?

Refer to Exhibit: A SOC analyst is designing a playbook to filter for a high severity event and attach the event information to an incident. Which local connector action must the analyst use in this scenario?

Refer to the exhibit. How do you add a piece of evidence to the Action Logs Marked As Evidence area? (Choose one answer) (缺图)

A customer wants FortiAnalyzer to run an automation stitch that executes a CLI command on FortiGate to block a predefined list of URLs, if a botnet command-and-control (C&C) server IP is detected. Which FortiAnalyzer feature must you use to start this automation process?

Refer to the exhibit. You are reviewing the Triggering Events page for a FortiSIEM incident. You want to remove the Reporting IP column because you have only one firewall in the topology. How do you accomplish this? (Choose one answer)（含图）

Which statement best describes the MITRE ATT&CK framework?

Which FortiAnalyzer feature uses the SIEM database for advance log analytics and monitoring?

Refer to the exhibits. What can you conclude from analyzing the data using the threat hunting module?

Refer to the exhibit. You notice that the custom event handler you configured to detect SMTP reconnaissance activities is creating a large number of events. This is overwhelming your notification system. How can you fix this?

When does FortiAnalyzer generate an event?

Refer to the exhibits. You configured a custom event handler and an associated rule to generate events whenever FortiMail detects spam emails. However, you notice that the event handler is generating events for both spam emails and clean emails. Which change must you make in the rule so that it detects only spam emails?

Refer to the exhibits. You configured a custom event handler and an associated rule to generate events whenever FortiMail detects spam emails. However, you notice that the event handler is generating events for both spam emails and clean emails. Which change must you make in the rule so that it detects only spam emails?

Refer to the exhibit. Which method most effectively reduces the attack surface of this organization? (Choose one answer)（含图）

Which statement describes automation stitch integration between FortiGate and FortiAnalyzer?

Refer to the exhibits. The DOS attack playbook is configured to create an incident when an event handler generates a denial-of-ser/ice (DoS) attack event. Why did the DOS attack playbook fail to execute?

Exhibit: Which observation about this FortiAnalyzer Fabric deployment architecture is true?