Fortinet NSE7_SOC_AR-7.6 試験概要:

Fortinet NSE7_SOC_AR-7.6 認定試験の出題範囲：

参照：https://training.fortinet.com/local/staticpage/view.php?page=security_operations_architect_exam

Fortinet NSE 7 - Security Operations 7.6 Architect 認定 NSE7_SOC_AR-7.6 試験問題：

問題 #1
Refer to the exhibit.

You want to configure a FortiSIEM rule that triggers when a FortiMail device reports at least 100 recipient verification failures for different email accounts in the domain acmecorp.net. What would you add or modify to accomplish this task? Choose one answer.

A. Change the status attribute filter from Status CONTAIN FAIL to Status CUSTOM EXPRESSION FAIL > = 100.
B. Add a filter for Mail Receiver CONTAIN acmecorp.net.
C. Add a filter for Mail Receiver > = 100.
D. Change the aggregate to COUNT(Distinct Mail Receiver) > = 100.

問題 #2
While monitoring your network, you discover that one FortiGate device is sending significantly more logs to FortiAnalyzer than all of the other FortiGate devices in the topology.
Additionally, the ADOM that the FortiGate devices are registered to consistently exceeds its quota.
What are two possible solutions? (Choose two.)

A. Reconfigure the first FortiGate device to reduce the number of logs it forwards to FortiAnalyzer.
B. Configure data selectors to filter the data sent by the first FortiGate device.
C. Increase the storage space quota for the first FortiGate device.
D. Create a separate ADOM for the first FortiGate device and configure a different set of storage policies.

問題 #3
Refer to this partial incident output:
Condition: if this pattern occurs within any 1800-second time window.
Host Interface Name: Red Hat VirtIO Ethernet Adapter
Recv Packet Errors: 0
Sent Packet Errors: 0
Recv Packet Discards: 37
Sent Packet Discards: 0
Recv Packet Error Pct: 0.00
Sent Packet Error Pct: 0.00
Recv Packet Discard Pct: 7.17
Sent Packet Discard Pct: 0.00
Avg Recv Interface Error: 0.00
Avg Sent Interface Error: 0.00
Avg Recv Interface Discard: 16.45
Avg Sent Interface Discard: 0.00
Which conclusion can you make about this incident? Choose one answer.

A. It was triggered from a FortiAI machine learning rule.
B. It was triggered by a correlation rule.
C. It was triggered by a baseline profile incident rule.
D. It was triggered by a lookup table.

問題 #4
Based on the Pyramid of Pain model, which two statements accurately describe the value of an indicator and how difficult it is for an adversary to change? (Choose two answers)

A. Tools are easy because often, multiple alternatives exist.
B. IP addresses are easy because adversaries can spoof them or move them to new resources.
C. Tactics, techniques, and procedures are hard because adversaries must adapt their methods.
D. Artifacts are easy because adversaries can alter file paths or registry keys.

問題 #5
Match the FortiSOAR architecture element to its description.
Select each FortiSOAR architecture element in the left column and drag and drop it into the blank space next to its corresponding description in the right column. After matching an element, you can move it again if you want to change your answer. You must match four elements with their descriptions in the work area.

解説：