Free Fortinet NSE7_SOC_AR-7.6 Exam Questions

Question 1

Refer to the exhibit. You notice that the custom event handler you configured to detect SMTP reconnaissance activities is creating a large number of events. This is overwhelming your notification system. How can you fix this?

A : Increase the trigger count so that it identifies and reduces the count triggered by a particular group.

B : Disable the custom event handler because it is not working as expected.

C : Decrease the time range that the custom event handler covers during the attack.

D : Increase the log field value so that it looks for more unique field values when it creates the event.

Answer: A

Question 2

Refer to the exhibit. You notice that the custom event handler you configured to detect SMTP reconnaissance activities is creating a large number of events. This is overwhelming your notification system. How can you fix this?

A : Increase the trigger count so that it identifies and reduces the count triggered by a particular group.

B : Disable the custom event handler because it is not working as expected.

C : Decrease the time range that the custom event handler covers during the attack.

D : Increase the log field value so that it looks for more unique field values when it creates the event.

Answer: A

Question 3

Refer to the exhibit. Assume that all devices in the FortiAnalyzer Fabric are shown in the image. Which two statements about the FortiAnalyzer Fabric deployment are true? (Choose two.)

A : FortiGate-B1 and FortiGate-B2 are in a Security Fabric.

B : There is no collector in the topology.

C : All FortiGate devices are directly registered to the supervisor.

D : FAZ-SiteA has two ADOMs enabled.

Answer: A,D

Question 4

Refer to the exhibit. Assume that all devices in the FortiAnalyzer Fabric are shown in the image. Which two statements about the FortiAnalyzer Fabric deployment are true? (Choose two.)

A : FortiGate-B1 and FortiGate-B2 are in a Security Fabric.

B : There is no collector in the topology.

C : All FortiGate devices are directly registered to the supervisor.

D : FAZ-SiteA has two ADOMs enabled.

Answer: A,D

Question 5

Refer to the exhibit. You notice that the custom event handler you configured to detect SMTP reconnaissance activities is creating a large number of events. This is overwhelming your notification system. How can you fix this?

A : Increase the trigger count so that it identifies and reduces the count triggered by a particular group.

B : Disable the custom event handler because it is not working as expected.

C : Decrease the time range that the custom event handler covers during the attack.

D : Increase the log field value so that it looks for more unique field values when it creates the event.

Answer: A