Free FCSS_SOC_AN-7.4: FCSS - Security Operations 7.4 Analyst Exam Questions and Answers

An administrator configures FAZ-A as the Fabric supervisor. On FAZ-B, the administrator sets the Fabric role to member and enters the IP address of FAZ-A. In the Fabric topology on FAZ-A, FAZ-B appears with a pending status and none of its events are visible. What must the administrator do to complete the Fabric membership?

• AA. Restart FAZ-B so the Fabric member role takes effect
• BB. Add FAZ-B to FAZ-A as a managed device in Device Manager
• CC. Authorize FAZ-B on FAZ-A from the Fabric member list
• DD. Configure log forwarding from FAZ-B to FAZ-A in aggregation mode

A SOC team built a playbook in the root ADOM and wants to reuse it in a second ADOM on the same FortiAnalyzer. Which method is supported?

• AA. Back up the FortiAnalyzer configuration and restore it with only the second ADOM selected
• BB. Export the playbook from the root ADOM and import the file into the second ADOM
• CC. Enable Fabric sharing on the playbook so that other ADOMs can run it
• DD. Edit the playbook properties and change its ADOM membership to the second ADOM

A FortiAnalyzer administrator enabled the outbreak alert event handlers. FortiAnalyzer is receiving logs from all registered FortiGate devices and can reach FortiGuard servers. Several days later, no outbreak alert events or outbreak reports appear. What should the administrator verify?

• AA. The ADOM is configured with a log retention period of at least 90 days
• BB. The Fabric supervisor has authorized the outbreak alert handlers
• CC. The FortiGuard Outbreak Detection Service license is valid on FortiAnalyzer
• DD. The FortiGate devices have the antivirus profile set to block mode

Refer to the exhibit. Exhibit: Event handler rule Log type: Traffic Filter: action == deny Group by: srcip Trigger: at least 5 matching logs within 10 minutes Logs received in the last 30 minutes srcip action logs distribution 10.0.1.10 deny 4 all within 8 minutes 10.0.1.20 deny 7 all within 6 minutes 10.0.1.30 deny 6 one log every 5 minutes 10.0.1.40 accept 9 all within 5 minutes For which source IP addresses does FortiAnalyzer generate events?

• AA. 10.0.1.10 and 10.0.1.20
• BB. 10.0.1.20 and 10.0.1.40
• CC. 10.0.1.20 only
• DD. 10.0.1.20 and 10.0.1.30

A FortiAnalyzer unit named FAZ-C receives logs from branch FortiGate devices and forwards them to an analyzer. An analyst logs in to FAZ-C and cannot find Incidents & Events or Reports in the GUI. What is the reason?

• AA. FAZ-C operates in collector mode, which does not provide analytics features
• BB. The ADOM mode on FAZ-C is set to normal instead of advanced
• CC. The analyst account lacks the Super_User profile in the root ADOM
• DD. FAZ-C has no FortiAnalyzer Fabric supervisor to enable these modules

During an investigation, an analyst finds that an attacker compressed several internal files into an archive on a file server. Two hours later, FortiGate logs show 4.2 GB of data uploaded from that server to an external file-sharing website over HTTPS. Which MITRE ATT&CK tactic does the upload represent?

• AA. Collection
• BB. Impact
• CC. Exfiltration
• DD. Command and Control

Refer to the exhibit. Exhibit: Playbook: Block Malicious IP Trigger: EVENT_TRIGGER (matched) Task 1 Get Events (Local connector) Status: Success Events returned: 1 Task 2 Add IP to Address Group (FortiOS) Status: Failed Response: HTTP 403 Forbidden Message: API user does not have permission for firewall.address The playbook ran but did not block the IP address on the FortiGate. What is the cause?

• AA. The FortiGate is unreachable from FortiAnalyzer on the HTTPS port configured in the connector
• BB. The Get Events task returned no data for Task 2 to use as an input
• CC. The event did not match the playbook trigger conditions, so Task 2 did not run correctly
• DD. The REST API administrator used by the connector has an access profile without write access to firewall objects

A SOC team wants to place decoy systems that imitate production servers so that any attacker interaction with them generates a high-fidelity alert. Which Fortinet product provides this capability?

• AA. FortiSandbox
• BB. FortiDeceptor
• CC. FortiEDR
• DD. FortiNDR

An analyst reviewing endpoint telemetry finds that a malicious process read the memory of lsass.exe on a domain-joined workstation to extract password hashes. Which MITRE ATT&CK tactic and technique does this behavior map to?

• AA. Credential Access: OS Credential Dumping
• BB. Defense Evasion: Process Injection
• CC. Lateral Movement: Use Alternate Authentication Material
• DD. Privilege Escalation: Access Token Manipulation

Refer to the exhibit. Exhibit: Endpoint and network activity for host WKS-114 14:02 winword.exe spawned powershell.exe 14:05 powershell.exe connected to 203.0.113.50:443, repeating every 60 seconds 14:20 7z.exe created C:\Temp\q3.7z from files on \\FS01\Finance 14:31 powershell.exe sent 4.2 GB to 203.0.113.50:443 Which MITRE ATT&CK tactic does the activity at 14:31 represent?

• AA. Impact
• BB. Command and Control
• CC. Exfiltration
• DD. Collection