Free Access to Fortinet.FCSS_SOC_AN-7.4.v2025-09-04.q46 with Valid Practice Test (Page 5)

Question 16

Refer to the Exhibit:

An analyst wants to create an incident and generate a report whenever FortiAnalyzer generates a malicious attachment event based on FortiSandbox analysis. The endpoint hosts are protected by FortiClient EMS integrated with FortiSandbox. All devices are logging to FortiAnalyzer.
Which connector must the analyst use in this playbook?

A.FortiSandbox connector
B.FortiClient EMS connector
C.FortiMail connector
D.Local connector

Correct Answer: A

* Understanding the Requirements:
* The objective is to create an incident and generate a report based on malicious attachment events detected by FortiAnalyzer from FortiSandbox analysis.
* The endpoint hosts are protected by FortiClient EMS, which is integrated with FortiSandbox. All logs are sent to FortiAnalyzer.
* Key Components:
* FortiAnalyzer: Centralized logging and analysis for Fortinet devices.
* FortiSandbox: Advanced threat protection system that analyzes suspicious files and URLs.
* FortiClient EMS: Endpoint management system that integrates with FortiSandbox for endpoint protection.
* Playbook Analysis:
* The playbook in the exhibit consists of three main actions:GET_EVENTS,RUN_REPORT, andCREATE_INCIDENT.
* EVENT_TRIGGER: Starts the playbook when an event occurs.
* GET_EVENTS: Fetches relevant events.
* RUN_REPORT: Generates a report based on the events.
* CREATE_INCIDENT: Creates an incident in the incident management system.
* Selecting the Correct Connector:
* The correct connector should allow fetching events related to malicious attachments analyzed by FortiSandbox and facilitate integration with FortiAnalyzer.
* Connector Options:
* FortiSandbox Connector:
* Directly integrates with FortiSandbox to fetch analysis results and events related to malicious attachments.
* Best suited for getting detailed sandbox analysis results.
* Selected as it is directly related to the requirement of handling FortiSandbox analysis events.
* FortiClient EMS Connector:
* Used for managing endpoint security and integrating with endpoint logs.
* Not directly related to fetching sandbox analysis events.
* Not selected as it is not directly related to the sandbox analysis events.
* FortiMail Connector:
* Used for email security and handling email-related logs and events.
* Not applicable for sandbox analysis events.
* Not selected as it does not relate to the sandbox analysis.
* Local Connector:
* Handles local events within FortiAnalyzer itself.
* Might not be specific enough for fetching detailed sandbox analysis results.
* Not selected as it may not provide the required integration with FortiSandbox.
* Implementation Steps:
* Step 1: Ensure FortiSandbox is configured to send analysis results to FortiAnalyzer.
* Step 2: Use the FortiSandbox connector in the playbook to fetch events related to malicious attachments.
* Step 3: Configure theGET_EVENTSaction to use the FortiSandbox connector.
* Step 4: Set up theRUN_REPORTandCREATE_INCIDENTactions based on the fetched events.
References:
* Fortinet Documentation on FortiSandbox Integration FortiSandbox Integration Guide
* Fortinet Documentation on FortiAnalyzer Event Handling FortiAnalyzer Administration Guide By using the FortiSandbox connector, the analyst can ensure that the playbook accurately fetches events based on FortiSandbox analysis and generates the required incident and report.

Question 17

Refer to the exhibit,

which shows the partial output of the MITRE ATT&CK Enterprise matrix on FortiAnalyzer.
Which two statements are true? (Choose two.)

A.There are four techniques that fall under tactic T1071.
B.There are four subtechniques that fall under technique T1071.
C.There are event handlers that cover tactic T1071.
D.There are 15 events associated with the tactic.

Question 18

A customer wants FortiAnalyzer to run an automation stitch that executes a CLI command on FortiGate to block a predefined list of URLs, if a botnet command-and-control (C&C) server IP is detected.
Which FortiAnalyzer feature must you use to start this automation process?

A.Playbook
B.Data selector
C.Event handler
D.Connector

Question 19

Refer to the Exhibit:

An analyst wants to create an incident and generate a report whenever FortiAnalyzer generates a malicious attachment event based on FortiSandbox analysis. The endpoint hosts are protected by FortiClient EMS integrated with FortiSandbox. All devices are logging to FortiAnalyzer.
Which connector must the analyst use in this playbook?

A.FortiSandbox connector
B.FortiClient EMS connector
C.FortiMail connector
D.Local connector

Correct Answer: A

Understanding the Requirements:
The objective is to create an incident and generate a report based on malicious attachment events detected by FortiAnalyzer from FortiSandbox analysis.
The endpoint hosts are protected by FortiClient EMS, which is integrated with FortiSandbox. All logs are sent to FortiAnalyzer.
Key Components:
FortiAnalyzer: Centralized logging and analysis for Fortinet devices.
FortiSandbox: Advanced threat protection system that analyzes suspicious files and URLs.
FortiClient EMS: Endpoint management system that integrates with FortiSandbox for endpoint protection.
Playbook Analysis:
The playbook in the exhibit consists of three main actions: GET_EVENTS, RUN_REPORT, and CREATE_INCIDENT.
EVENT_TRIGGER: Starts the playbook when an event occurs.
GET_EVENTS: Fetches relevant events.
RUN_REPORT: Generates a report based on the events.
CREATE_INCIDENT: Creates an incident in the incident management system.
Selecting the Correct Connector:
The correct connector should allow fetching events related to malicious attachments analyzed by FortiSandbox and facilitate integration with FortiAnalyzer. Connector Options:
FortiSandbox Connector:
Directly integrates with FortiSandbox to fetch analysis results and events related to malicious attachments.
Best suited for getting detailed sandbox analysis results.
Selected as it is directly related to the requirement of handling FortiSandbox analysis events.
FortiClient EMS Connector:
Used for managing endpoint security and integrating with endpoint logs.
Not directly related to fetching sandbox analysis events.
Not selected as it is not directly related to the sandbox analysis events.
FortiMail Connector:
Used for email security and handling email-related logs and events.
Not applicable for sandbox analysis events.
Not selected as it does not relate to the sandbox analysis.
Local Connector:
Handles local events within FortiAnalyzer itself.
Might not be specific enough for fetching detailed sandbox analysis results. Not selected as it may not provide the required integration with FortiSandbox. Implementation Steps:
Step 1: Ensure FortiSandbox is configured to send analysis results to FortiAnalyzer.
Step 2: Use the FortiSandbox connector in the playbook to fetch events related to malicious attachments.
Step 3: Configure the GET_EVENTS action to use the FortiSandbox connector.
Step 4: Set up the RUN_REPORT and CREATE_INCIDENT actions based on the fetched events.
Reference: Fortinet Documentation on FortiSandbox Integration FortiSandbox Integration Guide Fortinet Documentation on FortiAnalyzer Event Handling FortiAnalyzer Administration Guide By using the FortiSandbox connector, the analyst can ensure that the playbook accurately fetches events based on FortiSandbox analysis and generates the required incident and report.

Question 20

Refer to the exhibits.

You configured a custom event handler and an associated rule to generate events whenever FortiMail detects spam emails. However, you notice that the event handler is generating events for both spam emails and clean emails.
Which change must you make in the rule so that it detects only spam emails?

A.In the Log Type field, select Anti-Spam Log (spam)
B.In the Log filter by Text field, type type==spam.
C.Disable the rule to use the filter in the data selector to create the event.
D.In the Trigger an event when field, select Within a group, the log field Spam Name (snane) has 2 or more unique values.

Question 16

Question 17

Question 18

Question 19

Question 20

Download PDF File