Free FCSS-SOC-AN-7-4 sample questions
Real questions from the Fortinet FCSS - Security Operations 7.4 Analyst practice bank, with the correct answer and an explanation for each one. No junk, no filler.
Try them in the simulator Same questions, with study, timed and flashcard modes.
Showing 10 of 20 free sample questions.
A junior SOC analyst observes an event in FortiAnalyzer indicating a successful user login from an IP address geolocated in a country where the company has no employees. This is followed by the creation of a new administrative account. According to the MITRE ATT&CK framework, which two tactics are most clearly demonstrated by this sequence of events? (Select TWO).
A retail company is expanding its FortiAnalyzer deployment to handle logs from new stores. The current setup consists of a single FortiAnalyzer in analyzer mode at the headquarters. The new stores have unstable WAN connections. The company requires centralized analysis and reporting at HQ but needs to ensure logs are not lost during WAN outages at the store level. What is the most appropriate architectural change?
A SOC manager wants to create a custom dashboard in FortiAnalyzer to monitor for potential data exfiltration. The dashboard needs a chart that displays the top 10 users by the volume of data uploaded to `Cloud.Storage` applications. What is the correct `dataset` that should be used to build this chart?
An administrator configures an event handler to trigger an alert when more than 100 failed login attempts occur from a single source IP within 5 minutes. After deploying the handler, the SOC team receives numerous false positive alerts from an internal vulnerability scanner. What is the most effective way to modify the event handler to ignore the scanner while still monitoring other sources?
What is the primary function of the `fazlic-op-mode` CLI command on a FortiAnalyzer device?
A SOC analyst is investigating a security incident and needs to determine if a suspicious file, identified by its SHA256 hash, has been seen anywhere else in the network over the past 30 days. The analyst has access to logs from FortiGate, FortiSandbox, and FortiClient. Which FortiAnalyzer feature provides the most efficient way to perform this cross-device search for the indicator of compromise (IOC)?
A security architect is configuring a webhook connector in a FortiAnalyzer playbook. The purpose of this connector is to send alert details to a custom-built internal chat application. The chat application's API requires the 'Content-Type' header to be set to 'application/json'. Where in the FortiAnalyzer GUI would the architect configure this custom HTTP header for the webhook connector?
Case Study: **Company Background:** Global Logistics Inc. (GLI) is a multinational shipping company with a central data center and over 50 branch offices worldwide. Each branch office has a local FortiGate, and the central data center houses a high-performance FortiAnalyzer cluster running in analyzer mode. **Current Situation:** GLI's SOC team, located at the data center, is struggling with visibility into threats at the branch offices. The branches are connected via MPLS links of varying quality and bandwidth. The SOC team reports significant delays in receiving logs, and during network brownouts, logs are often lost, causing compliance issues and hindering timely incident response. **Requirements:** The new Head of Security Operations has mandated a new architecture to solve these issues. The key requirements are: 1) Eliminate log loss from branches during network instability. 2) Reduce non-essential log traffic over the WAN links. 3) Maintain centralized visibility and advanced threat analysis at the central SOC. 4) The solution must be managed within the existing Fortinet ecosystem. Which solution best meets all of GLI's requirements?
A SOC analyst is reviewing an incident in FortiAnalyzer and notices that an attacker used a PowerShell command to download a file from a remote server, a technique identified as T1059.001 (PowerShell) and T1105 (Ingress Tool Transfer). What is the primary role of FortiAnalyzer in identifying this type of adversary behavior?
10 more free samples are waiting
Create a free account to unlock the whole FCSS-SOC-AN-7-4 sample bank, or get full access to all 254 practice questions in the simulator.