NSE7-SOC-AR-7-6Preview

Review the incident report.
An attacker identified employee names, roles, and email patterns from public press releases, which were then used to craft tailored emails. The emails were directed to recipients to review an attached agenda using a link hosted off the corporate domain.
Which two MITRE ATT&CK tactics best fit this report? (Choose two.)

Refer to the exhibit.

How do you add a piece of evidence to the Action Logs Marked As Evidence area?

Review the incident report.
Packet captures show a host maintaining periodic TLS sessions that imitate normal HTTPS traffic but run on TCP 8443 to a single external host. An analyst flags the traffic as potential command-and-control. During the same period, the host issues frequent DNS queries with oversized TXT payloads to an attacker-controlled domain, transferring staged files.
Which two MITRE ATT&CK techniques best describe this activity? (Choose two.)

A partner organization recently had sensitive data exfiltrated by a well-known adversary group. You are tasked with threat hunting to see your organization is also affected.
Which action must you take first?

You are trying to create a playbook that creates a manual task that shows a list of public IPv6 addresses.
You were successful in extracting all IP addresses om a previous action into a variable called ip_list, which has a mix of private and public IPv4 and IPv6 addresses. Now, you must filter the results to display only public IPv6 addresses.
Which two Jinja expressions can accomplish this task? (Choose two.)

You want to automate a workflow on FortiSOAR so that whenever an incident with critical severity is moved to the containment phase, it is automatically reassigned to an L3 analyst as the incident lead.
Which two steps will accomplish this task? (Choose two.)

Refer to the exhibit.

You must configure the FortiGate connector to allow FortiSOAR to perform actions on a firewall. However, the connection fails.
Which two configurations are required? (Choose two.)

DRAG DROP -
Match the FortiSIEM device type to its description.
Select each FortiSIEM device type in the left column, hold and drag it to the blank space next to its corresponding description in the column on the right. Once you match a device type to its description, you can move it again if you want to change your answer by clicking on the device type name. You need to match four device types to its description in the work area.

When configuring an Ingest Bulk Feed playbook step, which two restrictions must you consider? (Choose two.)

When you use a manual trigger to save user input as a variable, what is the correct Jinja expression to reference the variable?

What are three capabilities of the built-in FortiSOAR Jinja editor? (Choose three.)

Refer to the exhibit.

What are the two mistakes in the incident subpattern rule configuration? (Choose two.)

Which three factors does the FortiSIEM rules engine use to determine the count when it evaluates the aggregate condition COUNT (Matched Events) on a specific subpattern? (Choose three.)

Which three statements accurately describe step utilities in a playbook step? (Choose three.)

Refer to the exhibit.

Based on the configuration shown in the exhibit, what are two misconfigurations? (Choose two.)

Refer to the exhibits.

You are searching for permitted traffic to public destination IP addresses outside of North America. Your investigation shows that one local computer is communicating with destination IP addresses that fit the criteria. However, you also notice that some of those IP addresses are duplicates, and you must aggregate the results.
Which three steps do you need to use to configure the Group By and Display Fields window to show only aggregated results? (Choose three.)

You configured a queue called L1 Analysts, and generated shifts to cover morning, evenings, and overnight shifts, with two members covering each shift.
However, you noticed that all members of the queue are assigned ingested alerts in a round-robin fashion, instead of only users who are currently on shift.
What is the problem?

Refer to the exhibits.

You configured the FortiSIEM connector on FortiSOAR. However, when you try to save the configuration, you see the error shown in the exhibit.
What are two possible causes? (Choose two.)

Refer to the exhibits.

How is the investigation and remediation output generated on FortiSIEM?

Refer to the exhibit.

A list of FortiSIEM connector actions is shown.
You want to create a playbook on FortiSOAR that allows you to accomplish the following:
Manually input a range of IP addresses.
Use the connector action in the exhibit to retrieve a list of devices from the FortiSIEM configuration management database (CMDB) within that IP address range.
For each returned result, create an asset record based on the IP address of the device.
Which combination and order of step operations fulfills the requirements with the fewest required playbook steps?

Refer to the exhibit.

You created a threat hunting playbook to perform a search query using the FortiSIEM connector. However, when you run the playbook, you do not see any output.
Which step must you take first in your troubleshooting process?

Refer to the exhibit.

You are trying to find traffic flows to destinations that are in Europe or Asia, for hosts in the local LAN segment. However, the query returns no results. Assume these logs exist on FortiSIEM.
Which three mistakes can you see in the query shown in the exhibit? (Choose three.)