Free Access to Fortinet.FCSS_SOC_AN-7.4.v2025-09-04.q46 with Valid Practice Test (Page 3)

Question 6

Exhibit:

Which observation about this FortiAnalyzer Fabric deployment architecture is true?

A.The AMER HQ SOC team cannot run automation playbooks from the Fabric supervisor.
B.The AMER HQ SOC team must configure high availability (HA) for the supervisor node.
C.The EMEA SOC team has access to historical logs only.
D.The APAC SOC team has access to FortiView and other reporting functions.

Question 7

How do playbook templates benefit SOC operations?

A.By serving as a decorative element in the SOC
B.By increasing the complexity of incident response
C.By providing standardized responses to common security scenarios
D.By reducing the need for IT personnel

Question 8

What should be a priority when configuring playbook tasks to ensure effective SOC automation?

A.Making tasks visible to external stakeholders
B.Ensuring tasks are scheduled during office hours only
C.Aligning tasks with the specific stages of incident response
D.Limiting tasks to non-critical alerts

Question 9

Which of the following should be a priority when monitoring SOC playbooks?

A.Monitoring the personal emails of SOC analysts
B.Checking for the timely execution of tasks
C.Watching for unusual increases in playbook file sizes
D.Ensuring that playbooks are printed and distributed

Question 10

Refer to the exhibits.

You configured a spearphishing event handler and the associated rule. However. FortiAnalyzer did not generate an event.
When you check the FortiAnalyzer log viewer, you confirm that FortiSandbox forwarded the appropriate logs, as shown in the raw log exhibit.
What configuration must you change on FortiAnalyzer in order for FortiAnalyzer to generate an event?

A.In the Log Type field, changethe selection toAntiVirus Log(malware).
B.Configure a FortiSandbox data selector and add it tothe event handler.
C.In the Log Filter by Text field, type the value:.5 ub t ype ma Iwa re..
D.Change trigger condition by selecting. Within a group, the log field Malware Kame (mname> has 2 or more unique values.

Correct Answer: B

* Understanding the Event Handler Configuration:
* The event handler is set up to detect specific security incidents, such as spearphishing, based on logs forwarded from other Fortinet products like FortiSandbox.
* An event handler includes rules that define the conditions under which an event should be triggered.
* Analyzing the Current Configuration:
* The current event handler is named "Spearphishing handler" with a rule titled "Spearphishing Rule 1".
* The log viewer shows that logs are being forwarded by FortiSandbox but no events are generated by FortiAnalyzer.
* Key Components of Event Handling:
* Log Type: Determines which type of logs will trigger the event handler.
* Data Selector: Specifies the criteria that logs must meet to trigger an event.
* Automation Stitch: Optional actions that can be triggered when an event occurs.
* Notifications: Defines how alerts are communicated when an event is detected.
* Issue Identification:
* Since FortiSandbox logs are correctly forwarded but no event is generated, the issue likely lies in the data selector configuration or log type matching.
* The data selector must be configured to include logs forwarded by FortiSandbox.
* Solution:
* B. Configure a FortiSandbox data selector and add it to the event handler:
* By configuring a data selector specifically for FortiSandbox logs and adding it to the event handler, FortiAnalyzer can accurately identify and trigger events based on the forwarded logs.
* Steps to Implement the Solution:
* Step 1: Go to the Event Handler settings in FortiAnalyzer.
* Step 2: Add a new data selector that includes criteria matching the logs forwarded by FortiSandbox (e.g., log subtype, malware detection details).
* Step 3: Link this data selector to the existing spearphishing event handler.
* Step 4: Save the configuration and test to ensure events are now being generated.
* Conclusion:
* The correct configuration of a FortiSandbox data selector within the event handler ensures that FortiAnalyzer can generate events based on relevant logs.
References:
* Fortinet Documentation on Event Handlers and Data Selectors FortiAnalyzer Event Handlers
* Fortinet Knowledge Base for Configuring Data Selectors FortiAnalyzer Data Selectors By configuring a FortiSandbox data selector and adding it to the event handler, FortiAnalyzer will be able to accurately generate events based on the appropriate logs.

Question 6

Question 7

Question 8

Question 9

Question 10

Download PDF File