NSE7-SOC-AR-7-6: Fortinet NSE 7 - Security Operations 7.6 ArchitectDemo

By Fortinet · Question Mode

QuestionQ57

SOAR Incident Handling and Threat Hunting

A partner organization recently experienced a distributed denial-of-service (DDoS) attack, but the adversary’s identity and TTPs are still unknown.

Your SOC has received no relevant threat intelligence from the partner organization, yet you are asked to determine whether comparable activity might be occurring in your environment.

Which threat-hunting action should you take first?

  • A Develop a hunting hypothesis based on how DDoS can be executed against your network.
  • B Use threat intelligence to enrich the IP addresses of all external source IP addresses.
  • C Configure SIEM rules to alert when inbound traffic exceeds baseline thresholds.
  • D Use a packet analyzer to capture and review all traffic flows on critical devices.
Explanation

Threat hunting starts by developing a testable hypothesis from the available context. With no known adversary indicators or TTPs to investigate, a hypothesis about how DDoS could be carried out against the network defines the relevant data, behaviors, and validation steps for the hunt.

Community Discussion

No comments yet. Be the first to start the discussion!