NSE7 ADVANCE ANALITYS

How can you invoke an integration policy on FortiSIEM rules?

• Through Notification Policy settings

• Through Incident Notification settings

• Through remediation scripts

• Through External Authentication settings

How do customers connect to a shared multi-tenant instance on FortiSOAR?

• The MSSP must provide secure network connectivity between the FortiSOAR manager node and the customer devices.

• The MSSP must install a Secure Message Exchange node to connect to the customer's shared multi-tenant instance.

• The customer must install a tenant node to connect to the MSSP shared multi-tenant instance.

• The MSSP must install an agent node on the customer's network to connect to the customer's shared multi-tenant instance.

In the event of a WAN link failure between the collector and the supervisor, by default, what is the maximum number of event files stored on the collector?

• 30,000

• 10,000

• 40,000

• 20,000

What is the disadvantage of automatic remediation?

• It can make a disruptive change to a user, block access to an application, or disconnect critical systems from the network.

• It is equivalent to running an IPS in monitor-only mode — watches but does not block.

• External threats or attacks detected by FortiSIEM will need user interaction to take action on an already overworked SOC team.

• Threat behaviors occurring during the night could take hours to respond to.

What are the modes of Data Ingestion on FortiSOAR? (Choose three.)

• Rule based

• Notification based

• App Push

• Policy based

• Schedule based

How can you empower SOC by deploying FortiSOAR? (Choose three.)

• Aggregate logs from distributed systems

• Collaborative knowledge sharing

• Baseline user and traffic behavior

• Reduce human error

• Address analyst skills gap

Which of the following are two Tactics in the MITRE ATT&CK framework? (Choose two.)

• Rootkit

• Reconnaissance

• Discovery

• BITS Jobs

• Phishing

Refer to the exhibit. Click on the calculator button.

Based on the information provided in the exhibit, calculate the unused events for the next three minutes for a 520 EPS license

• 72460

• 73460

• 74460

• 71460

Refer to the exhibit.

An administrator wants to remediate the incident from FortiSIEM shown in the exhibit.

What option is available to the administrator?

• Quarantine IP FortiClient

• Run the block MAC FortiOS.

• Run the block IP FortiOS 5.4

• Run the block domain Windows DNS

Refer to the exhibit.

The window for this rule is 30 minutes.

What is this rule tracking?

• A sudden 50% increase in WMI response times over a 30-minute time window

• A sudden 1.50 times increase in WMI response times over a 30-minute time window

• A sudden 75% increase in WMI response times over a 30-minute time window

• A sudden 150% increase in WMI response times over a 30-minute time window