FCSS_SOC_AN-7.4問題集、Fortinet実際の試験問題

質問 1

What is a key objective of managing outbreak alert handlers in a SOC?

A. To increase sales and marketing efforts

B. To ensure seamless business operations

C. To quickly contain and mitigate threats

D. To minimize the impact of false positives

正解: C

質問 2

Refer to the exhibits.

What can you conclude from analyzing the data using the threat hunting module?

A. DNS tunneling is being used to extract confidential data from the local network.

B. FTP is being used as command-and-control (C&C) technique to mine for data.

C. Spearphishing is being used to elicit sensitive information.

D. Reconnaissance is being used to gather victim identity information from the mail server.

正解: A

解説: (PassTest メンバーにのみ表示されます)

質問 3

Which MITRE ATT&CK technique category involves collecting information about the environment and systems?

A. Exfiltration

B. Lateral Movement

C. Credential Access

D. Discovery

正解: D

質問 4

Which three end user logs does FortiAnalyzer use to identify possible IOC compromised hosts? (Choose three.)

A. Web filter logs

B. DNS filter logs

C. Email filter logs

D. IPS logs

E. Application filter logs

正解: A,B,D

解説: (PassTest メンバーにのみ表示されます)

質問 5

In the context of SOC operations, mapping adversary behaviors to MITRE ATT&CK techniques primarily helps in:

A. Understanding the attack lifecycle

B. Facilitating regulatory compliance

C. Predicting future attacks

D. Speeding up system recovery

正解: A

質問 6

Which component of the Fortinet SOC solution is best suited for centralized log management?

A. FortiGate

B. FortiClient

C. FortiSandbox

D. FortiAnalyzer

正解: D

質問 7

Which two statements about the FortiAnalyzer Fabric topology are true? (Choose two.)

A. Logging devices must be registered to the supervisor.

B. Downstream collectors can forward logs to Fabric members.

C. The supervisor uses an API to store logs, incidents, and events locally.

D. Fabric members must be in analyzer mode.

正解: A,D

解説: (PassTest メンバーにのみ表示されます)

質問 8

Refer to the exhibits.

You configured a spearphishing event handler and the associated rule. However. FortiAnalyzer did not generate an event.
When you check the FortiAnalyzer log viewer, you confirm that FortiSandbox forwarded the appropriate logs, as shown in the raw log exhibit.
What configuration must you change on FortiAnalyzer in order for FortiAnalyzer to generate an event?

A. Change trigger condition by selecting. Within a group, the log field Malware Kame (mname> has 2 or more unique values.

B. Configure a FortiSandbox data selector and add it tothe event handler.

C. In the Log Type field, change the selection to AntiVirus Log(malware).

D. In the Log Filter by Text field, type the value: .5 ub t ype ma Iwa re..

正解: B

解説: (PassTest メンバーにのみ表示されます)

質問 9

Refer to Exhibit:

A SOC analyst is designing a playbook to filter for a high severity event and attach the event information to an incident.
Which local connector action must the analyst use in this scenario?

A. Attach Data to Incident

B. Update Asset and Identity

C. Get Events

D. Update Incident

正解: A

解説: (PassTest メンバーにのみ表示されます)

Fortinet FCSS - Security Operations 7.4 Analyst - FCSS_SOC_AN-7.4 模擬練習