NSE7_SOC_AR-7.6 practice questions 1–7

1. Question 1 · 7 in bank

   Refer to the exhibit.

   

   You are reviewing the Triggering Events page for a FortiSIEM incident. You want to remove the Reporting IP column because you have only one firewall in the topology. How do you accomplish this?

   • ACustomize the display columns for this incident.
   • BRemove the Reporting IP attribute from the raw logs using parsing rules.
   • CDisable correlation for the Reporting IP field in the rule subpattern.
   • DClear the Reporting IP field from the Triggered Attributes section when you configure the Incident Action.

   Show answer

   Answer: A

   Next question

2. Question 2 · 7 in bank

   Refer to the exhibit.

   

   You are investigating an open incident and want to add records from the Tickets module, a custom module, to the visual correlation widget. Assume there are already linked ticket records to the incident. How do you accomplish this?

   • AEdit the incident template and add the Tickets module to the graph.
   • BDefine move module relationships under Correlation Settings.
   • CTag ticket records with the incident ID.
   • DIngest ticket records through a custom connector.

   Show answer

   Answer: A

   Next question

3. Question 3 · 7 in bank

   Select 3

   Refer to the exhibit.

   

   You are trying to find traffic flows to destinations that are in Europe or Asia, for hosts in the local LAN segment. However, the query returns no results. Assume these logs exist on FortiSIEM. Which three mistakes can you see in the query shown in the exhibit? (Choose three.)

   • AThe logical operator for the first row (Group: Europe) must be OR.
   • BThe null value cannot be used with the IS NOT operator.
   • CThe time range must be Absolute for queries that use configuration management database (CMDB) groups.
   • DThe Source IP row operator must be BETWEEN 10.0.0.0, 10.200.200.254.
   • EThere are missing parentheses between the first row (Group: Europe) and the second row (Group: Asia).

   Show answer

   Answer: ADE

   Next question

4. Question 4 · 7 in bank

   Refer to the exhibit.

   

   A list of FortiSIEM connector actions is shown. You want to create a playbook on FortiSOAR that allows you to accomplish the following: Manually input a range of IP addresses. Use the connector action in the exhibit to retrieve a list of devices from the FortiSIEM configuration management database (CMDB) within that IP address range. For each returned result, create an asset record based on the IP address of the device. Which combination and order of step operations fulfills the requirements with the fewest required playbook steps?

   • A1) Connector action, 2) Create record, 3) Update record
   • B1) On create trigger, 2) Connector action, 3) Code snippet, 4) Create record
   • C1) Manual trigger, 2) Connector action, 3) Create record
   • D1) Manual trigger, 2) Set variable, 3) Connector action, 4) Create record, 5) Update record

   Show answer

   Answer: B

   Next question

5. Question 5 · 7 in bank

   Select 3

   Which three statements accurately describe step utilities in a playbook step? (Choose three.)

   • AThe Mock Output step utility uses HTML format to simulate real outputs.
   • BThe Loop step utility can only be used once in each playbook step.
   • CThe Condition step utility behavior changes depending on if a loop exists for that step.
   • DThe Timeout step utility sets a maximum execution time for the step and terminates playbook execution, if exceeded.
   • EThe Variables step utility stores the output of the step directly in the step itself.

   Show answer

   Answer: BCD

   Next question

6. Question 6 · 7 in bank

   Refer to the exhibit.

   

   How do you add a piece of evidence to the Action Logs Marked As Evidence area?

   • ABy creating an evidence collection task and attaching a file
   • BBy linking an indicator to the war room
   • CBy tagging output or a workspace comment with the keyword Evidence
   • DBy executing a playbook with the Save Execution Logs option enabled

   Show answer

   Answer: D

   Next question

7. Question 7 · 7 in bank

   Select 2

   You are configuring a new FortiSIEM rule to trigger incidents based on receiving a number of either Fortigate-Traffic-Violation OR Fortigate-Traffic-Denied event types. You could use a single subpattern for this, but you decided to create two separate subpatterns, one for each event type, and correlate them using the OR operator. Which two benefits does this approach provide? (Choose two.)

   • AEach subpattern can use a different group by condition.
   • BEach subpattern can use a different time window condition.
   • CEach subpattern can use a different aggregate condition.
   • DEach subpattern can trigger its own notification policy.

   Show answer

   Answer: AB

Keyboard:J Kmove between questionsA–Dselect an answerRshow or hide the answer← →change page

NSE7_SOC_AR-7.6 practice, question 1. 7 questions available.