NO.23 Refer to Exhibit:

A SOC analyst is creating the Malicious File Detected playbook to run when FortiAnalyzer generates a malicious file event. The playbook must also update the incident with the malicious file event data.
What must the next task in this playbook be?

NO.24 Which MITRE ATT&CK technique category involves collecting information about the environment and systems?

NO.25 Which role does a threat hunter play within a SOC?

NO.26 In monitoring SOC playbooks, what is a critical indicator of a need for updates or adjustments?

NO.27 Refer to Exhibit:

You are tasked with reviewing a new FortiAnalyzer deployment in a network with multiple registered logging devices. There is only one FortiAnalyzer in the topology.
Which potential problem do you observe?

NO.28 Refer to the exhibits.

You configured a spearphishing event handler and the associated rule. However. FortiAnalyzer did not generate an event.
When you check the FortiAnalyzer log viewer, you confirm that FortiSandbox forwarded the appropriate logs, as shown in the raw log exhibit.
What configuration must you change on FortiAnalyzer in order for FortiAnalyzer to generate an event?

NO.29 Refer to Exhibit:

A SOC analyst is designing a playbook to filter for a high severity event and attach the event information to an incident.
Which local connector action must the analyst use in this scenario?

NO.30 You are tasked with configuring automation to quarantine infected endpoints.
Which two Fortinet SOC components can work together to fulfill this task?
(Choose two.)

NO.31 Which three end user logs does FortiAnalyzer use to identify possible IOC compromised hosts? (Choose three.)

NO.32 Which two statements about the FortiAnalyzer Fabric topology are true? (Choose two.)

NO.33 Refer to the exhibits.



The Quarantine Endpoint by EMS playbook execution failed.
What can you conclude from reviewing the playbook tasks and raw logs?

NO.34 What is the primary function of event handlers in a SOC operation?

NO.35 What should be prioritized when analyzing threat hunting information feeds?
(Choose Two)

NO.36 Which connector on FortiAnalyzer is responsible for looking up indicators to get threat intelligence?

NO.37 Refer to the exhibit.

You notice that the custom event handler you configured to detect SMTP reconnaissance activities is creating a large number of events. This is overwhelming your notification system.
How can you fix this?

NO.38 What should be a priority when configuring playbook tasks to ensure effective SOC automation?

NO.39 What is the primary goal of a Security Operations Center (SOC) when analyzing security incidents?

NO.40 Which of the following are critical when analyzing and managing events and incidents in a SOC?
(Choose Two)

NO.41 What is the primary purpose of configuring playbook triggers in SOC automation?

NO.42 Your company is doing a security audit To pass the audit, you must take an inventory of all software and applications running on all Windows devices Which FortiAnalyzer connector must you use?

NO.43 When configuring playbook triggers, what factor is essential to optimize the efficiency of automated responses?

NO.44 Refer to the exhibits.
Domain List:

Domain abc.com:

Which connector and action on FortiAnalyzer can you use to add the entries show in the exhibits?

NO.45 What is the advantage of integrating advanced analytics in the management of events and incidents in a SOC?