最新的Fortinet NSE 7 - Security Operations 7.6 Architect - NSE7_SOC_AR-7.6免費考試真題
問題1
Which of the following are critical when analyzing and managing events and incidents in a SOC? (Choose two answers)
正確答案: A,D
說明：（僅 VCESoft 成員可見）
問題2
Refer to the exhibit.
You notice that the custom event handler you configured to detect SMTP reconnaissance activities is creating a large number of events. This is overwhelming your notification system.
How can you fix this?
You notice that the custom event handler you configured to detect SMTP reconnaissance activities is creating a large number of events. This is overwhelming your notification system.
How can you fix this?
正確答案: A
說明：（僅 VCESoft 成員可見）
問題3
Which two best practices should be followed when exporting playbooks in FortiAnalyzer? (Choose two answers)
正確答案: A,C
說明：（僅 VCESoft 成員可見）
問題4
Review the incident report:
Packet captures show a host maintaining periodic TLS sessions that imitate normal HTTPS traffic but run on TCP 8443 to a single external host. An analyst flags the traffic as potential command-and-control. During the same period, the host issues frequent DNS queries with oversized TXT payloads to an attacker-controlled domain, transferring staged files.
Which two MITRE ATT & CK techniques best describe this activity? (Choose two answers)
Packet captures show a host maintaining periodic TLS sessions that imitate normal HTTPS traffic but run on TCP 8443 to a single external host. An analyst flags the traffic as potential command-and-control. During the same period, the host issues frequent DNS queries with oversized TXT payloads to an attacker-controlled domain, transferring staged files.
Which two MITRE ATT & CK techniques best describe this activity? (Choose two answers)
正確答案: B,C
說明：（僅 VCESoft 成員可見）
問題5
Refer to the exhibit.
You must configure the FortiGate connector to allow FortiSOAR to perform actions on a firewall. However, the connection fails. Which two configurations are required? (Choose two answers)
You must configure the FortiGate connector to allow FortiSOAR to perform actions on a firewall. However, the connection fails. Which two configurations are required? (Choose two answers)
正確答案: B,D
說明：（僅 VCESoft 成員可見）
問題6
Based on the Pyramid of Pain model, which two statements accurately describe the value of an indicator and how difficult it is for an adversary to change? (Choose two answers)
正確答案: B,D
說明：（僅 VCESoft 成員可見）
問題7
Your company is doing a security audit To pass the audit, you must take an inventory of all software and applications running on all Windows devices Which FortiAnalyzer connector must you use?
正確答案: B
說明：（僅 VCESoft 成員可見）
問題8
Refer to the exhibits.
Assume that the traffic flows are identical, except for the destination IP address. There is only one FortiGate in network address translation (NAT) mode in this environment.
Based on the exhibits, which two conclusions can you make about this FortiSIEM incident? (Choose two answers)
Assume that the traffic flows are identical, except for the destination IP address. There is only one FortiGate in network address translation (NAT) mode in this environment.
Based on the exhibits, which two conclusions can you make about this FortiSIEM incident? (Choose two answers)
正確答案: C,D
說明：（僅 VCESoft 成員可見）
問題9
A FortiSOAR playbook includes a Wait step that is configured to pause execution after initiating a reputation lookup on an indicator. Which two configurations of the Wait step are valid? Choose two answers.
正確答案: A,D
說明：（僅 VCESoft 成員可見）
問題10
Refer to the exhibits.
How is the investigation and remediation output generated on FortiSIEM? (Choose one answer)
How is the investigation and remediation output generated on FortiSIEM? (Choose one answer)
正確答案: B
說明：（僅 VCESoft 成員可見）
