Fortinet FCSS - Security Operations 7.4 Analyst - FCSS_SOC

QUESTION NO: 1
You are managing 10 FortiAnalyzer devices in a FortiAnalyzer Fabric. In this scenario, what is a benefit of configuring a Fabric group?

A. You can configure separate logging rates per group. B. You can filter log search results based on the group. C. You can apply separate data storage policies per group. D. You can aggregate and compress logging data for the devices in the group.

Correct Answer: B

QUESTION NO: 2
According to the National Institute of Standards and Technology (NIST) cybersecurity framework, incident handling activities can be divided into phases.
In which incident handling phase do you quarantine a compromised host in order to prevent an adversary from using it as a stepping stone to the next phase of an attack?

A. Analysis B. Eradication C. Containment D. Recovery

Correct Answer: C

Explanation: Only visible for Pass4Test members. You can sign-up / login (it's free).

QUESTION NO: 3
Which FortiAnalyzer connector can you use to run automation stitches9

A. FortiOS B. FortiMail C. Local D. FortiCASB

Correct Answer: A

Explanation: Only visible for Pass4Test members. You can sign-up / login (it's free).

QUESTION NO: 4
How does identifying adversary behavior benefit SOC operations in terms of incident response?

A. By increasing the time it takes to respond to incidents B. By reducing the importance of endpoint security C. By providing data for marketing strategies D. By allowing for a quicker isolation of affected systems

Correct Answer: D

QUESTION NO: 5
Which three end user logs does FortiAnalyzer use to identify possible IOC compromised hosts? (Choose three.)

A. Web filter logs B. Email filter logs C. Application filter logs D. DNS filter logs E. IPS logs

Correct Answer: A,D,E

Explanation: Only visible for Pass4Test members. You can sign-up / login (it's free).

QUESTION NO: 6
In monitoring SOC playbooks, what is a critical indicator of a need for updates or adjustments?

A. The number of visitors to the SOC B. The frequency of team-building activities C. A decrease in coffee consumption by SOC staff D. An increase in unresolved security alerts

Correct Answer: D

QUESTION NO: 7
What is the impact of poorly configured playbook triggers in a SOC environment?

A. Decreased accuracy in automated responses B. Enhanced personal relationships among SOC staff C. Improved efficiency of threat detection D. Increased marketing capabilities

Correct Answer: A

QUESTION NO: 8
Refer to the exhibit.

You notice that the custom event handler you configured to detect SMTP reconnaissance activities is creating a large number of events. This is overwhelming your notification system.
How can you fix this?

A. Increase the log field value so that it looks for more unique field values when it creates the event. B. Increase the trigger count so that it identifies and reduces the count triggered by a particular group. C. Disable the custom event handler because it is not working as expected. D. Decrease the time range that the custom event handler covers during the attack.

Correct Answer: B

Explanation: Only visible for Pass4Test members. You can sign-up / login (it's free).

QUESTION NO: 9
A customer wants FortiAnalyzer to run an automation stitch that executes a CLI command on FortiGate to block a predefined list of URLs, if a botnet command-and-control (C&C) server IP is detected.
Which FortiAnalyzer feature must you use to start this automation process?

A. Data selector B. Event handler C. Playbook D. Connector

Correct Answer: B

Explanation: Only visible for Pass4Test members. You can sign-up / login (it's free).

Fortinet FCSS - Security Operations 7.4 Analyst - FCSS_SOC_AN-7.4 Exam Questions