Fortinet FCSS_SOC_AN-7.4 問題集

質問 1：
What role do outbreak alert handlers play in a SOC?
A. They provide automated responses to detected outbreaks.
B. They predict stock market changes.
C. They facilitate corporate mergers and acquisitions.
D. They coordinate marketing campaigns.
正解：A

質問 2：
Which two assets are available with the outbreak alert licensed feature on FortiAnalyzer?
(Choose two.)
A. Outbreak-specific custom playbooks
B. Custom event handlers from FortiGuard
C. Custom outbreak reports
D. Custom connectors from FortiGuard
正解：B,C

質問 3：
Which MITRE ATT&CK technique category involves collecting information about the environment and systems?
A. Credential Access
B. Lateral Movement
C. Exfiltration
D. Discovery
正解：D

質問 4：
Why is it crucial to configure playbook triggers based on accurate threat intelligence?
A. To facilitate easier management of office supplies
B. To prevent the triggering of irrelevant or false positive actions
C. To ensure SOC parties are well-attended
D. To increase the number of digital advertisements
正解：B

質問 5：
Refer to the exhibits.

You configured a spearphishing event handler and the associated rule. However. FortiAnalyzer did not generate an event.
When you check the FortiAnalyzer log viewer, you confirm that FortiSandbox forwarded the appropriate logs, as shown in the raw log exhibit.
What configuration must you change on FortiAnalyzer in order for FortiAnalyzer to generate an event?
A. In the Log Type field, change the selection to AntiVirus Log(malware).
B. In the Log Filter by Text field, type the value: .5 ub t ype ma Iwa re..
C. Change trigger condition by selecting. Within a group, the log field Malware Kame (mname> has 2 or more unique values.
D. Configure a FortiSandbox data selector and add it tothe event handler.
正解：D
解説: (Topexam メンバーにのみ表示されます)

質問 6：
Refer to the exhibit.

Assume that all devices in the FortiAnalyzer Fabric are shown in the image.
Which two statements about the FortiAnalyzer Fabric deployment are true? (Choose two.)
A. All FortiGate devices are directly registered to the supervisor.
B. There is no collector in the topology.
C. FortiGate-B1 and FortiGate-B2 are in a Security Fabric.
D. FAZ-SiteA has two ADOMs enabled.
正解：C,D
解説: (Topexam メンバーにのみ表示されます)

質問 7：
Refer to Exhibit:

A SOC analyst is designing a playbook to filter for a high severity event and attach the event information to an incident.
Which local connector action must the analyst use in this scenario?
A. Update Incident
B. Attach Data to Incident
C. Update Asset and Identity
D. Get Events
正解：B
解説: (Topexam メンバーにのみ表示されます)