100% Free Fortinet NSE7_SOC_AR-7.6 Practice Test Questions

Question 1

Refer to the exhibit. You notice that the custom event handler you configured to detect SMTP reconnaissance activities is creating a large number of events. This is overwhelming your notification system. How can you fix this?

A : Increase the trigger count so that it identifies and reduces the count triggered by a particular group.

B : Disable the custom event handler because it is not working as expected.

C : Decrease the time range that the custom event handler covers during the attack.

D : Increase the log field value so that it looks for more unique field values when it creates the event.

Answer: A

Question 2

When you use a manual trigger to save user input as a variable, what is the correct Jinja expression to reference the variable? (Choose one answer)

A :

B :

C :

D :

Answer: A

Question 3

A customer wants FortiAnalyzer to run an automation stitch that executes a CLI command on FortiGate to block a predefined list of URLs, if a botnet command-and-control (C&C) server IP is detected. Which FortiAnalyzer feature must you use to start this automation process?

A : Playbook

B : Data selector

C : Event handler

D : Connector

Answer: C

Question 4

Refer to the exhibit. You notice that the custom event handler you configured to detect SMTP reconnaissance activities is creating a large number of events. This is overwhelming your notification system. How can you fix this?

A : Increase the trigger count so that it identifies and reduces the count triggered by a particular group.

B : Disable the custom event handler because it is not working as expected.

C : Decrease the time range that the custom event handler covers during the attack.

D : Increase the log field value so that it looks for more unique field values when it creates the event.

Answer: A

Question 5

When you use a manual trigger to save user input as a variable, what is the correct Jinja expression to reference the variable? (Choose one answer)

A :

B :

C :

D :

Answer: A

100% Free NSE7_SOC_AR-7.6 Practice Exam Questions and Answers