Free Fortinet NSE7_SOC_AR-7.6 Exam Questions

Question 1

A customer wants FortiAnalyzer to run an automation stitch that executes a CLI command on FortiGate to block a predefined list of URLs, if a botnet command-and-control (C&C) server IP is detected. Which FortiAnalyzer feature must you use to start this automation process?

A : Playbook

B : Data selector

C : Event handler

D : Connector

Answer: C

Question 2

A very long FortiSOAR playbook failed at step 30 because of an intermittent networking issue, which has now been resolved. You want to finish executing the playbook without repeating earlier steps or losing prior context. Which action should you take? Choose one answer.

A : Use mock input for step 30 and re-run the playbook.

B : Use the Load ENV JSON option in the Jinja Editor and then render the output.

C : Use the Rerun From Last Failed Step option from the executed playbook logs.

D : Add a connector from the trigger to step 30 directly and re-run the playbook.

Answer: C

Question 3

A very long FortiSOAR playbook failed at step 30 because of an intermittent networking issue, which has now been resolved. You want to finish executing the playbook without repeating earlier steps or losing prior context. Which action should you take? Choose one answer.

A : Use mock input for step 30 and re-run the playbook.

B : Use the Load ENV JSON option in the Jinja Editor and then render the output.

C : Use the Rerun From Last Failed Step option from the executed playbook logs.

D : Add a connector from the trigger to step 30 directly and re-run the playbook.

Answer: C

Question 4

When you use a manual trigger to save user input as a variable, what is the correct Jinja expression to reference the variable? (Choose one answer)

A :

B :

C :

D :

Answer: A

Question 5

Refer to the exhibits.Assume that the traffic flows are identical, except for the destination IP address. There is only one FortiGatein network address translation (NAT) mode in this environment.Based on the exhibits, which two conclusions can you make about this FortiSIEM incident? (Choose twoanswers)

A : The client 10.200.3.219 is conducting active reconnaissance.

B : FortiGate is not routing the packets to the destination hosts.

C : The destination hosts are not responding.

D : FortiGate is blocking the return flows.

Answer: A,C