Fortinet NSE 7 - Security Operations 7.6 Architect - NSE7_SOC_AR-7.6 Exam Practice Test

Which two ways can you create an incident on FortiAnalyzer? (Choose two answers)

Your company is doing a security audit To pass the audit, you must take an inventory of all software and applications running on all Windows devices Which FortiAnalyzer connector must you use?

You created a war room and want to run a connector action to look up the reputation of a domain. Then, you need to save the output for your team to review. However, there is a lot of output, and you want to limit the amount of information attached to the war room. How do you accomplish this? Choose one answer.

Which two statements accurately describe the process to create a new rule from a search using FortiSIEM analytics? Choose two answers.

You need to create a nested query in FortiSIEM that satisfies the following conditions:
Find all devices discovered by any FortiSIEM Windows Agent.
From those devices, identify those that have generated Windows Login Failure events.
Which two query components should be used for this nested query? Choose two answers.

Which three end user logs does FortiAnalyzer use to identify possible IOC compromised hosts? (Choose three.)

According to the National Institute of Standards and Technology (NIST) cybersecurity framework, incident handling activities can be divided into phases.
In which incident handling phase do you quarantine a compromised host in order to prevent an adversary from using it as a stepping stone to the next phase of an attack?

Refer to Exhibit:
A SOC analyst is designing a playbook to filter for a high severity event and attach the event information to an incident.
Which local connector action must the analyst use in this scenario?

You configured a new module named Users. Next, you want to configure a playbook that creates users from ingested data. When new records are created, you want to ensure that duplicate users do not overwrite existing user records and their fields. However, you also want the playbook to continue running even if duplicates are encountered so that any non-duplicate records are still created. Which two actions fulfill the requirements?
Choose two answers.

While monitoring your network, you discover that one FortiGate device is sending significantly more logs to FortiAnalyzer than all of the other FortiGate devices in the topology.
Additionally, the ADOM that the FortiGate devices are registered to consistently exceeds its quota.
What are two possible solutions? (Choose two.)