Fortinet NSE 7 - Security Operations 7.6 Architect - NSE7_SOC

QUESTION NO: 1
Refer to the exhibit.
Which two options describe how the Update Asset and Identity Database playbook is configured? (Choose two.)

A. The playbook is using a FortiMail connector. B. The playbook is using an on-demand trigger. C. The playbook is using a FortiClient EMS connector. D. The playbook is using a local connector.

Correct Answer: C,D

Explanation: Only visible for Pass4Test members. You can sign-up / login (it's free).

QUESTION NO: 2
Refer to the exhibit.

What is the correct Jinja expression to filter the results to show only the MD5 hash values?
{{ [slot 1]|[slot 2] [slot 3].[slot 4] }}
Select the jinja expression in the left column, hold and drag it to a blank position on the right. Place the four correct steps in order, placing the first step in the first slot. Once you place an expression, you can move it again if you want to change your answer before moving to the next question. You need to drop four jinja expressions in the work area.
Select and drag the screen divider to change the viewable area of the source and work areas.

Correct Answer:

Explanation:
Slot 1: vars.artifacts
Slot 2: json_query
Slot 3: ( " data.results[?type== ' FileHash-MD5 ' ]
Slot 4: value
Exact Extract: "You can assign specific fields from your connector action output to their own variables and further manipulate the data using Jinja filters. This approach allows you to efficiently extract, clean, and prepare information for use in later steps of your automation." Exact Extract: The guide shows the same Jinja pattern:
{{ vars.steps.Advanced_Search_Query.data.events | json_query( ' [].attributes.srcIpAddr ' ) | unique }} and explains that similar Jinja logic applies to extracting other variables from structured output.
The correct expression is {{ vars.artifacts | json_query( " data.results[?type== ' FileHash-MD5 ' ].value " ) }} because the JSON object stores artifact records under vars.artifacts.data.results. Each object in results has a type and a value. The filter condition [?type== ' FileHash-MD5 ' ] selects only records whose type is FileHash-MD5 , and .value returns only the MD5 hash strings, not the full objects.
tojson is unnecessary because the data is already structured and queryable. results, data, and value alone are incomplete because they do not filter by artifact type. The key operation is json_query , which uses a JMESPath-style expression to filter a list and project only the required field.
Technical Deep Dive: This is a classic FortiSOAR playbook parsing pattern. Use json_query when the object is already JSON-like and you know the path. The expression returns a list such as:
[ " 6aad63bcc3dd4e148f3724808955f912 " , " 9fd2b1c0e4a37658bca9d0f1e2c34567 " ] This is automation-layer data extraction. FortiGate NP/CP offloading is irrelevant because no packet inspection or firewall data-plane forwarding is involved.

QUESTION NO: 3
A partner organization recently suffered a distributed denial-of-service (DDoS) attack, but the adversary's identity and TTPs remain unknown. Your SOC has not received any relevant threat intelligence from the partner organization, but you are asked to determine whether similar activity could be happening in your environment. Which threat hunting action should you perform first? Choose one answer.

A. Use a packet analyzer to capture and review all traffic flows on critical devices. B. Use threat intelligence to enrich the IP addresses of all external source IP addresses. C. Develop a hunting hypothesis based on how DDoS can be executed against your network. D. Configure SIEM rules to alert when inbound traffic exceeds baseline thresholds.

Correct Answer: C

Explanation: Only visible for Pass4Test members. You can sign-up / login (it's free).

QUESTION NO: 4
Which three are threat hunting activities? (Choose three answers)

A. Automate workflows. B. Perform packet analysis. C. Enrich records with threat intelligence. D. Generate a hypothesis. E. Tune correlation rules.

Correct Answer: B,C,D

Explanation: Only visible for Pass4Test members. You can sign-up / login (it's free).

QUESTION NO: 5
Refer to the exhibit.

A list of FortiSIEM connector actions is shown. You want to create a playbook on FortiSOAR that allows you to accomplish the following:
Manually input a range of IP addresses.
Use the connector action in the exhibit to retrieve a list of devices from the FortiSIEM configuration management database (CMDB) within that IP address range.
For each returned result, create an asset record based on the IP address of the device.
Which combination and order of step operations fulfills the requirements with the fewest required playbook steps?

A. 1) Manual trigger, 2) Set variable, 3) Connector action, 4) Create record, 5) Update record B. 1) On create trigger, 2) Connector action, 3) Code snippet, 4) Create record C. 1) Connector action, 2) Create record, 3) Update record D. 1) Manual trigger, 2) Connector action, 3) Create record

Correct Answer: D

Explanation: Only visible for Pass4Test members. You can sign-up / login (it's free).

QUESTION NO: 6
Which two phases are part of the FortiSOAR incident handling process but are not phases in the NIST 800-61 Revision 2 model? Choose two answers.

A. Preparation B. Confirmation C. Detection D. Identification

Correct Answer: B,D

Explanation: Only visible for Pass4Test members. You can sign-up / login (it's free).

QUESTION NO: 7
What are three capabilities of the built-in FortiSOAR Jinja editor? (Choose three answers)

A. It checks the validity of a Jinja expression. B. It defines conditions to trigger a playbook step. C. It renders output by combining Jinja expressions and JSON input. D. It loads the environment JSON of a recently executed playbook. E. It creates new records in bulk.

Correct Answer: A,C,D

Explanation: Only visible for Pass4Test members. You can sign-up / login (it's free).

QUESTION NO: 8
Which three end user logs does FortiAnalyzer use to identify possible IOC compromised hosts? (Choose three.)

A. Web filter logs B. Email filter logs C. Application filter logs D. DNS filter logs E. IPS logs

Correct Answer: A,D,E

Explanation: Only visible for Pass4Test members. You can sign-up / login (it's free).

QUESTION NO: 9
Refer to the exhibit.
Assume that all devices in the FortiAnalyzer Fabric are shown in the image.
Which two statements about the FortiAnalyzer Fabric deployment are true? (Choose two.)

A. FortiGate-B1 and FortiGate-B2 are in a Security Fabric. B. There is no collector in the topology. C. All FortiGate devices are directly registered to the supervisor. D. FAZ-SiteA has two ADOMs enabled.

Correct Answer: A,D

Explanation: Only visible for Pass4Test members. You can sign-up / login (it's free).

QUESTION NO: 10
Which statement best describes the MITRE ATT & CK framework?

A. It provides a high-level description of common adversary activities, but lacks technical details B. It describes attack vectors targeting network devices and servers, but not user endpoints. C. It covers tactics, techniques, and procedures, but does not provide information about mitigations. D. It contains some techniques or subtechniques that fall under more than one tactic.

Correct Answer: D

Explanation: Only visible for Pass4Test members. You can sign-up / login (it's free).

Fortinet NSE 7 - Security Operations 7.6 Architect - NSE7_SOC_AR-7.6 Exam Questions