Fortinet FCSS_SOC_AN-7.4 Quiz 1 Topic 4 Questions 1-5

Question: 1

When does FortiAnalyzer generate an event?

AWhen a log matches a filter in a data selector

BWhen a log matches an action in a connector

CWhen a log matches a rule in an event handler

DWhen a log matches a task in a playbook

Show Answer

Question: 2

Refer to the exhibit,

q2_FCSS_SOC_AN-7.4

which shows the partial output of the MITRE ATT&CK Enterprise matrix on FortiAnalyzer.

Which two statements are true? (Choose two.)

AThere are four techniques that fall under tactic T1071.

BThere are four subtechniques that fall under technique T1071.

CThere are event handlers that cover tactic T1071.

DThere are 15 events associated with the tactic.

Show Answer

Question: 3

Which two ways can you create an incident on FortiAnalyzer? (Choose two.)

AUsing a connector action

BManually, on the Event Monitor page

CBy running a playbook

DUsing a custom event handler

Show Answer

Question: 4

Refer to the exhibits.

q4_FCSS_SOC_AN-7.4

The DOS attack playbook is configured to create an incident when an event handler generates a denial-of-ser/ice (DoS) attack event.

Why did the DOS attack playbook fail to execute?

AThe Create SMTP Enumeration incident task is expecting an integer value but is receiving the incorrect data type

BThe Get Events task is configured to execute in the incorrect order.

CThe Attach_Data_To_lncident task failed.

DThe Attach_Data_To_lncident task is expecting an integer value but is receiving the incorrect data type.

Show Answer

Question: 5

Review the following incident report:

Attackers leveraged a phishing email campaign targeting your employees.

The email likely impersonated a trusted source, such as the IT department, and requested login credentials.

An unsuspecting employee clicked a malicious link in the email, leading to the download and execution of a Remote Access Trojan (RAT).

The RAT provided the attackers with remote access and a foothold in the compromised system.

Which two MITRE ATT&CK tactics does this incident report capture? (Choose two.)

AInitial Access

BDefense Evasion

CLateral Movement

DPersistence

Show Answer

Fortinet FCSS_SOC_AN-7.4 Quiz:1 Topic:4 Questions:1-5