NSE7_SOC_AR-7.6 Exam Dumps and Practice Questions

Understanding the Playbook Configuration:

The playbook named 'Update Asset and Identity Database' is designed to update the FortiAnalyzer Asset and Identity database with endpoint and user information.

The exhibit shows the playbook with three main components: ON_SCHEDULE STARTER, GET_ENDPOINTS, and UPDATE_ASSET_AND_IDENTITY.

Analyzing the Components:

ON_SCHEDULE STARTER: This component indicates that the playbook is triggered on a schedule, not on-demand.

GET_ENDPOINTS: This action retrieves information about endpoints, suggesting it interacts with an endpoint management system.

UPDATE_ASSET_AND_IDENTITY: This action updates the FortiAnalyzer Asset and Identity database with the retrieved information.

Evaluating the Options:

Option A: The actions shown in the playbook are standard local actions that can be executed by the FortiAnalyzer, indicating the use of a local connector.

Option B: There is no indication that the playbook uses a FortiMail connector, as the tasks involve endpoint and identity management, not email.

Option C: The playbook is using an 'ON_SCHEDULE' trigger, which contradicts the description of an on-demand trigger.

Option D: The action 'GET_ENDPOINTS' suggests integration with an endpoint management system, likely FortiClient EMS, which manages endpoints and retrieves information from them.

Conclusion:

The playbook is configured to use a local connector for its actions.

It interacts with FortiClient EMS to get endpoint information and update the FortiAnalyzer Asset and Identity database.

Fortinet Documentation on Playbook Actions and Connectors.

FortiAnalyzer and FortiClient EMS Integration Guides.

Exact Extract: ''FortiSOAR incident handling phases are closely aligned with NIST incident handling phases... The Post-Incident Activity phase is renamed Aftermath. Functionally, they are identical.''

Exact Extract: ''Use the Update Record step to update a record in a module within FortiSOAR. Use the Find Record step to find a record in a module within FortiSOAR.''

Exact Extract: ''Use the Manual Task step to pause the playbook's execution until you mark the task as skipped or completed.''

The correct answers are C, D, and E. The workflow must start when an existing incident is changed to the Aftermath phase, so the correct trigger is an On Update trigger with a condition that matches the incident phase. After the trigger fires, the incident already exists as the current playbook record, so a Find Record step is unnecessary. To set the incident status to Resolved and assign the purple team specialist as the incident lead, use an Update Record step. To create and assign the follow-up work item, use a Manual Task step assigned to the same specialist.

Option B is wrong because a Condition/Decision step evaluates logic; it does not assign records or create work. Option A is wrong because the playbook is already triggered by the updated incident record, so searching for matching incidents adds unnecessary complexity.

Exact Extract: ''You can investigate the war room by executing connector actions directly on the war room record. In the example shown on this slide, a Get Domain Reputation action was directly run with the VirusTotal connector on this record. You can select only relevant checkboxes or select Key to select all outputs.''

The correct answer is A. When running a connector action directly from the war room, FortiSOAR lets you choose which returned output keys to save. That is the correct way to limit what gets attached to the war room. B is wrong because a workspace filter affects display/collaboration, not what connector output is saved. C is incomplete; the Investigate tab is where you run the investigation, but the specific control is selecting output keys. D is wrong because playbook logging level does not control war room evidence attachment size.

Exact Extract: ''FortiSOAR assumes the Preparation phase is outside its incident handling scope because it is considered a pre-SOAR responsibility.''

Exact Extract: ''In FortiSOAR, the Detection and Analysis phases are expanded into Detection, Identification, and Confirmation... In the Identification phase, analysts can evaluate the alerts tied to the incident, understand the context, and enrich indicators. In the Confirmation phase, an analyst can confirm whether the incident is a true positive or a false positive.''

The correct answers are B and D. NIST 800-61 Revision 2 uses broader incident handling phases, including Preparation, Detection and Analysis, Containment, Eradication, Recovery, and Post-Incident Activity. FortiSOAR modifies that model by treating Preparation as outside SOAR scope and splitting NIST's Detection and Analysis into more operationally useful FortiSOAR phases: Detection, Identification, and Confirmation. Therefore, Identification and Confirmation are FortiSOAR-specific phase names that are not standalone NIST phases.

A is wrong because Preparation is a NIST phase, but FortiSOAR excludes it from its incident handling workflow. C is not the best answer because Detection is part of NIST's combined Detection and Analysis phase and is also present in FortiSOAR.

Understanding the Custom Event Handler Configuration:

The event handler is set up to generate events based on specific log data.

The goal is to generate events specifically for spam emails detected by FortiMail.

Analyzing the Issue:

The event handler is currently generating events for both spam emails and clean emails.

This indicates that the rule's filtering criteria are not correctly distinguishing between spam and non-spam emails.

Evaluating the Options:

Option A: Selecting the 'Anti-Spam Log (spam)' in the Log Type field will ensure that only logs related to spam emails are considered. This is the most straightforward and accurate way to filter for spam emails.

Option B: Typing type==spam in the Log filter by Text field might help filter the logs, but it is not as direct and reliable as selecting the correct log type.

Option C: Disabling the rule to use the filter in the data selector to create the event does not address the issue of filtering for spam logs specifically.

Option D: Selecting 'Within a group, the log field Spam Name (snane) has 2 or more unique values' is not directly relevant to filtering spam logs and could lead to incorrect filtering criteria.

Conclusion:

The correct change to make in the rule is to select 'Anti-Spam Log (spam)' in the Log Type field. This ensures that the event handler only generates events for spam emails.

Fortinet Documentation on Event Handlers and Log Types.

Best Practices for Configuring FortiMail Anti-Spam Settings.