Free Access to Fortinet.NSE7_SOC_AR-7.6.v2026-03-18.q26 with Valid Practice Test (Page 2)

Question 1

Refer to the exhibit.

You notice that the custom event handler you configured to detect SMTP reconnaissance activities is creating a large number of events. This is overwhelming your notification system.
How can you fix this?

A.Increase the trigger count so that it identifies and reduces the count triggered by a particular group.
B.Disable the custom event handler because it is not working as expected.
C.Decrease the time range that the custom event handler covers during the attack.
D.Increase the log field value so that it looks for more unique field values when it creates the event.

Correct Answer: A

* Understanding the Issue:
* The custom event handler for detecting SMTP reconnaissance activities is generating a large number of events.
* This high volume of events is overwhelming the notification system, leading to potential alert fatigue and inefficiency in incident response.
* Event Handler Configuration:
* Event handlers are configured to trigger alerts based on specific criteria.
* The frequency and volume of these alerts can be controlled by adjusting the trigger conditions.
* Possible Solutions:
* A. Increase the trigger count so that it identifies and reduces the count triggered by a particular group:
* By increasing the trigger count, you ensure that the event handler only generates alerts after a higher threshold of activity is detected.
* This reduces the number of events generated and helps prevent overwhelming the notification system.
* Selected as it effectively manages the volume of generated events.
* B. Disable the custom event handler because it is not working as expected:
* Disabling the event handler is not a practical solution as it would completely stop monitoring for SMTP reconnaissance activities.
* Not selected as it does not address the issue of fine-tuning the event generation.
* C. Decrease the time range that the custom event handler covers during the attack:
* Reducing the time range might help in some cases, but it could also lead to missing important activities if the attack spans a longer period.
* Not selected as it could lead to underreporting of significant events.
* D. Increase the log field value so that it looks for more unique field values when it creates the event:
* Adjusting the log field value might refine the event criteria, but it does not directly control the volume of alerts.
* Not selected as it is not the most effective way to manage event volume.
* Implementation Steps:
* Step 1: Access the event handler configuration in FortiAnalyzer.
* Step 2: Locate the trigger count setting within the custom event handler for SMTP reconnaissance.
* Step 3: Increase the trigger count to a higher value that balances alert sensitivity and volume.
* Step 4: Save the configuration and monitor the event generation to ensure it aligns with expected levels.
* Conclusion:
* By increasing the trigger count, you can effectively reduce the number of events generated by the custom event handler, preventing the notification system from being overwhelmed.
Fortinet Documentation on Event Handlers and Configuration FortiAnalyzer Administration Guide Best Practices for Event Management Fortinet Knowledge Base By increasing the trigger count in the custom event handler, you can manage the volume of generated events and prevent the notification system from being overwhelmed.

Question 2

Refer to the exhibit.

You must configure the FortiGate connector to allow FortiSOAR to perform actions on a firewall. However, the connection fails. Which two configurations are required? (Choose two answers)

A.Trusted hosts must be enabled and the FortiSOAR IP address must be permitted.
B.The VDOM name must be specified, or set to VDOM_1, if VDOMs are not enabled on FortiGate.
C.HTTPS must be enabled on the FortiGate interface that FortiSOAR will communicate with.
D.An API administrator must be created on FortiGate with the appropriate profile, along with a generated API key to configure on the connector.

Correct Answer: C,D

Comprehensive and Detailed Explanation From FortiSOAR 7.6., FortiSIEM 7.3 Exact Extract study guide:
To establish a successful integration betweenFortiSOAR 7.6and aFortiGatefirewall via the FortiGate connector, specific administrative and network requirements must be met on the FortiGate side:
* API Administrator and Key (D):FortiSOAR does not use standard UI login credentials. Instead, it requires aREST API Administratoraccount to be created on the FortiGate. This account must be assigned an administrative profile with the necessary permissions (e.g., Read/Write for Firewall policies or Address objects). Upon creation, the FortiGate generates a uniqueAPI Key, which must be entered into the "API Key" field of the FortiSOAR configuration wizard as shown in the exhibit.
* HTTPS Management Access (C):The connector communicates with the FortiGate using REST API calls overHTTPS(port 443 by default). Therefore, the physical or logical interface on the FortiGate that corresponds to the "Hostname" IP (172.16.200.1) must haveHTTPSenabled under "Administrative Access" in its network settings. If HTTPS is disabled, the connection will time out or be refused.
Why other options are incorrect:
* Trusted hosts (A):While it is a best practice to restrict API access to specific IPs (like the FortiSOAR IP), the integration can technically function without "Trusted hosts" enabled if the network allows the traffic. However, theabsenceof an API key or HTTPS access will definitively cause a failure regardless of trusted host settings.
* VDOM name (B):In the exhibit, the VDOM field contains multiple values ("VDOM_1", "VDOM_2").
If VDOMs are disabled on the FortiGate, this field should generally be left blank or set to the default
"root." Setting it specifically to "VDOM_1" when VDOMs are disabled is not a universal requirement for connectivity; the primary handshake depends on the API key and HTTPS connectivity.

Question 3

Refer to the exhibits.

The FortiMail Sender Blocklist playbook is configured to take manual input and add those entries to the FortiMail abc. com domain-level block list. The playbook is configured to use a FortiMail connector and the ADD_SENDER_TO_BLOCKLIST action.
Why is the FortiMail Sender Blocklist playbook execution failing7

A.You must use the GET_EMAIL_STATISTICS action first to gather information about email messages.
B.FortiMail is expecting a fully qualified domain name (FQDN).
C.The client-side browser does not trust the FortiAnalzyer self-signed certificate.
D.The connector credentials are incorrect

Question 4

Refer to Exhibit:
A SOC analyst is designing a playbook to filter for a high severity event and attach the event information to an incident.
Which local connector action must the analyst use in this scenario?

A.Get Events
B.Update Incident
C.Update Asset and Identity
D.Attach Data to Incident

Question 5

Which two statements about the FortiAnalyzer Fabric topology are true? (Choose two.)

A.Downstream collectors can forward logs to Fabric members.
B.Logging devices must be registered to the supervisor.
C.The supervisor uses an API to store logs, incidents, and events locally.
D.Fabric members must be in analyzer mode.

Question 1

Question 2

Question 3

Question 4

Question 5

Download PDF File