Online Access Free NSE7_SOC_AR-7.6 Exam Questions

Refer to the exhibit.
You notice that the custom event handler you configured to detect SMTP reconnaissance activities is creating a large number of events. This is overwhelming your notification system.
How can you fix this?

• A.Decrease the time range that the custom event handler covers during the attack.
• B.Increase the trigger count so that it identifies and reduces the count triggered by a particular group.
• C.Disable the custom event handler because it is not working as expected.
• D.Increase the log field value so that it looks for more unique field values when it creates the event.

Refer to the exhibit.

Which method most effectively reduces the attack surface of this organization? (Choose one answer)

• A.Remove unused devices.
• B.Enable deep inspection on firewall policies.
• C.Implement macrosegmentation.
• D.Forward all firewall logs to the security information and event management (SIEM) system.

A partner organization recently suffered a distributed denial-of-service (DDoS) attack, but the adversary's identity and TTPs remain unknown. Your SOC has not received any relevant threat intelligence from the partner organization, but you are asked to determine whether similar activity could be happening in your environment. Which threat hunting action should you perform first? Choose one answer.

• A.Use threat intelligence to enrich the IP addresses of all external source IP addresses.
• B.Develop a hunting hypothesis based on how DDoS can be executed against your network.
• C.Use a packet analyzer to capture and review all traffic flows on critical devices.
• D.Configure SIEM rules to alert when inbound traffic exceeds baseline thresholds.

A very long FortiSOAR playbook failed at step 30 because of an intermittent networking issue, which has now been resolved. You want to finish executing the playbook without repeating earlier steps or losing prior context. Which action should you take? Choose one answer.

• A.Use the Rerun From Last Failed Step option from the executed playbook logs.
• B.Use the Load ENV JSON option in the Jinja Editor and then render the output.
• C.Add a connector from the trigger to step 30 directly and re-run the playbook.
• D.Use mock input for step 30 and re-run the playbook.

Refer to Exhibit:
A SOC analyst is designing a playbook to filter for a high severity event and attach the event information to an incident.
Which local connector action must the analyst use in this scenario?

• A.Get Events
• B.Attach Data to Incident
• C.Update Asset and Identity
• D.Update Incident