Which three end user logs does FortiAnalyzer use to identify possible IOC compromised hosts? (Choose three answers)
Answer(s): A,C,E
Comprehensive and Detailed Explanation From FortiSOAR 7.6., FortiSIEM 7.3 Exact Extract study guide:In the context of the Fortinet Security Fabric, FortiAnalyzer performs Indicator of Compromise (IOC) detection by correlating various security logs against a threat intelligence database.3 The IOC engine specifically analyzes the following logs of each end user to identify potentially compromised hosts:Web Filter Logs (A): The engine parses web filtering logs to identify access attempts to blacklistedURLs, malicious domains, or IPs associated with known malware distribution sites.4 If a match is found in the threat database, the host is flagged as compromised.DNS Filter Logs (C): DNS requests are a primary indicator of a compromise. The engine monitors these logs for queries directed at known Command and Control (C2) servers or domains generated by Domain Generation Algorithms (DGA).5IPS Logs (E): Intrusion Prevention System (IPS) logs provide critical data on signature matches for known attacks. In newer Security Operations (SOC) curricula, IPS logs are used alongside Web and DNS logs to provide a high-fidelity assessment of whether a host is currently infected and attempting to communicate with an external threat actor.Why other options are incorrect:Email Filter Logs (B): While important for detecting phishing attempts (Initial Access), email logs are generally used for content filtering and antispam rather than being a primary source for the IOC engine's behavioral "calling home" detection in the FortiAnalyzer Compromised Hosts view.Application Filter Logs (D): Application control logs provide visibility into software usage but are less commonly used by the core IOC engine for identifying blacklisted network destinations compared to Web and DNS filtering.
Which two best practices should be followed when exporting playbooks in FortiAnalyzer? (Choose two answers)
Answer(s): A,B
Comprehensive and Detailed Explanation From FortiSOAR 7.6., FortiSIEM 7.3 Exact Extract study guide:According to the FortiAnalyzer 7.4 SOC Analyst official training material (Lesson 5: Automation) and supporting documentation for FortiSOAR 7.6 and FortiSIEM 7.3 integration, the following best practices are recommended for playbook portability:Disable playbooks before exporting (A): When a playbook is exported, its current status (Enabled or Disabled) is preserved in the export file. If an Enabled playbook is imported into a destination ADOMwhere its trigger conditions are immediately met, it will start executing automatically. Disabling the playbook before export is a critical best practice to prevent unintended automated actions from occurring in the new environment before the analyst has had a chance to verify local configurations.Include the associated connector settings (B): FortiAnalyzer allows you to include required connector configurations during the export process. By selecting this option, the exported file includes the necessary metadata and configurations for the connectors that the playbook relies on to execute its tasks. This ensures the playbook remains functional and portable across different FortiAnalyzer units or ADOMs without requiring the manual recreation of every connector.Why other options are incorrect:Move playbooks between ADOMs (C): There is no native "Move" function for automation playbooks between ADOMs in the same sense as moving a device. The standard supported workflow for transferring automation logic is the Export and Import process.Ensure names do not exist in target (D): While maintaining unique names is good practice, it is not a required "best practice" for the export process itself because FortiAnalyzer automatically handles name conflicts. If an imported playbook shares a name with an existing one, the system automatically appends a timestamp to the new playbook's name to avoid a conflict.
Which two ways can you create an incident on FortiAnalyzer? (Choose two answers)
Answer(s): A,D
Comprehensive and Detailed Explanation From FortiSOAR 7.6., FortiSIEM 7.3 Exact Extract study guide:In FortiAnalyzer 7.6 and related SOC versions, incidents serve as centralized containers for tracking and analyzing security events. There are two primary automated and manual methods to initiate an incident:Using a custom event handler (A): In FortiAnalyzer, event handlers are used to generate events from raw logs.1 A critical feature in recent versions is the Automatically Create Incident setting within a custom event handler.2 When enabled, the system automatically elevates a triggered event into a new incident record, allowing analysts to bypass the manual review of every individual event before an incident is raised.3By running a playbook (D): Playbooks provide a powerful way to automate the incident lifecycle.4 A playbook can be configured with an Event Trigger, meaning it executes as soon as an event matches specific criteria. One of the core actions available within these playbooks is the Create Incident action, which can automatically populate incident details, severity, and category based on the triggering event's data.5 This ensures high-fidelity events are consistently captured for investigation.Why other options are incorrect:Using a connector action (B): While connectors allow FortiAnalyzer to communicate with external systems (like ITSM or Security Fabric devices), the act of "creating an incident" inside FortiAnalyzer is a function of the internal event engine or playbook automation, not a standalone connector action used for external integration.Manually, on the Event Monitor page (C): While you can view, filter, and acknowledge events on the Event Monitor page, the process of manually raising an incident typically occurs from the Incidents module or by right-clicking an event to "Raise Incident" in the Log View or FortiView, rather than being a core function defined as occurring "on the Event Monitor page" in the same architectural sense as handlers and playbooks.
Which of the following are critical when analyzing and managing events and incidents in a SOC? (Choose two answers)
Answer(s): A,C
Comprehensive and Detailed Explanation From FortiSOAR 7.6., FortiSIEM 7.3 Exact Extract study guide:In a modern Security Operations Center (SOC) environment powered by FortiSIEM 7.3 and FortiSOAR 7.6, the efficiency of the incident response lifecycle depends on two primary pillars of analysis:Accurate detection of threats (A): The primary goal of a SOC is to identify genuine malicious activity. Using FortiSIEM's correlation rules and machine learning (UEBA), the system must be tuned to detect patterns that signify real risk. Accuracy ensures that the SOC is not blinded by noise and can focus on critical security events that impact the organization's posture.Rapid identification of false positives (C): "Alert Fatigue" is one of the greatest challenges in a SOC. Analysts must be able to quickly distinguish between legitimate anomalies (false positives) and actual threats. FortiSOAR assists in this by using automated playbooks to perform initial triage and "pre-processing"--such as checking IP reputations or verifying user activity--to automatically close or demote alerts that do not represent a true threat, thereby freeing up analysts for high-priority investigations.Why other options are incorrect:Immediate escalation for all alerts (B): This is a poor SOC practice. Escalating every alert without triage leads to analyst burnout and overloads senior responders with low-value tasks. The goal of a tiered SOC (Tier 1, Tier 2, Tier 3) is to filter alerts so only significant incidents are escalated.Periodic system downtime (D): SOC systems (SIEM/SOAR) are considered "Mission Critical" and must operate on a 24/7/365 basis. Maintenance should be performed using High Availability (HA)configurations or during "low-flow" windows without causing a complete stop in monitoring, as attackers often leverage downtime to strike.
You are trying to create a playbook that creates a manual task showing a list of public IPv6 addresses. You were successful in extracting all IP addresses from a previous action into a variable called ip_list, which contains both private and public IPv4 and IPv6 addresses. You must now filter the results to display only public IPv6 addresses. Which two Jinja expressions can accomplish this task? (Choose two answers)
Answer(s): B,D
Comprehensive and Detailed Explanation From FortiSOAR 7.6., FortiSIEM 7.3 Exact Extract study guide:In FortiSOAR 7.6, the playbook engine utilizes the powerful ipaddr family of Jinja filters (derived from the Ansible netaddr library) to manipulate network data. To isolate public IPv6 addresses from a mixed list, the order of operations in the filter chain ensures the correct data is extracted:Double Filtering Sequence (B): In the expression {{ vars.ip_list | ipaddr('public') | ipv6 }}, the first filter ipaddr('public') processes the entire list and retains only public addresses, including both IPv4 and IPv6 versions. The second filter in the pipe, | ipv6, then takes that subset of public addresses and filters them again to keep only those that conform to the IPv6 standard. The final result is a list containing only public IPv6 addresses.Version-First Filtering (D): In the expression {{ vars.ip_list | ipv6 | ipaddr('public') }}, the logic is reversed but equally effective. The first filter | ipv6 immediately strips all IPv4 and non-IP strings from the list, leaving only IPv6 addresses (both private and public). The subsequent filter | ipaddr('public') then evaluates these IPv6 addresses and discards any that fall within the private/unique-local ranges (like ULA or link-local), resulting in the same set of public IPv6 addresses.Why other options are incorrect:A (ipv6addr 'public'): While ipv6addr is a valid filter in many Ansible environments, FortiSOAR's standard documentation for manual task creation and data manipulation primarily emphasizes the use of the generic ipaddr filter with specific flags or chained version filters (like | ipv6) to ensure cross-compatibility with the underlying Python libraries used by the SOAR engine.C (!private syntax): The ipaddr filter utilizes specific keywords for classification. While "not private" is the logical requirement, the filter expects positive assertions such as 'public', 'private', or 'multicast'. The !private syntax is not a supported or documented operator for this filter within the Fortinet SOC ecosystem.
Post your Comments and Discuss Fortinet NSE7_SOC_AR-7.6 exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the NSE7_SOC_AR-7.6 content, but please register or login to continue.