Online Access Free NSE7_SOC_AR-7.6 Exam Questions

Refer to the exhibit.

The input of a FortiSIEM connector action is shown.
You want to create a playbook on FortiSOAR that allows you to accomplish the following:
Manually input an IP address.
Use the connector action in the exhibit to retrieve a device from the FortiSIEM configuration management database (CMDB) with that IP address.
Ask the SOC manager to review the information pulled from FortiSIEM about that device.
If the manager approves, an asset record is created.
Which combination and order of step operations fulfills the requirements with the fewest required playbook steps?

• A.Manual trigger, 2) Set Variable, 3) Connector action, 4) Set Variable, 5) Approval, 6) Create record
• B.On Create trigger, 2) Connector action, 3) Manual Task, 4) Create record
• C.Manual trigger, 2) Connector action, 3) Approval, 4) Create Record
• D.Connector action, 2) Approval, 3) Create record, 4) Update record

Refer to the exhibits.
The DOS attack playbook is configured to create an incident when an event handler generates a denial-of-ser
/ice (DoS) attack event.
Why did the DOS attack playbook fail to execute?

• A.The Get Events task is configured to execute in the incorrect order.
• B.The Create SMTP Enumeration incident task is expecting an integer value but is receiving the incorrect data type
• C.The Attach_Data_To_lncident task failed.
• D.The Attach_Data_To_lncident task is expecting an integer value but is receiving the incorrect data type.

You want to automate a workflow on FortiSOAR so that whenever an incident is moved to the Aftermath phase, it is automatically set to status Resolved and assigned to a purple team specialist as incident lead to write an incident report. In addition, a manual task, assigned to the same specialist, will be created so they are aware of the pending work. Which three steps will accomplish this task? Choose three answers.

• A.Create a Manual Task step to assign the task to the specialist.
• B.Create an Update Record step to set the incident lead.
• C.Create an On Update trigger with a trigger condition that matches the Aftermath phase.
• D.Create a Condition step to assign both the incident and task to the specialist.
• E.Create a Find Record step to find matching incidents.

Refer to the exhibit,
which shows the partial output of the MITRE ATT & CK Enterprise matrix on FortiAnalyzer.
Which two statements are true? (Choose two.)

• A.There are four techniques that fall under tactic T1071.
• B.There are four subtechniques that fall under technique T1071.
• C.There are 15 events associated with the tactic.
• D.There are event handlers that cover tactic T1071.

Refer to the exhibit.

What is the correct Jinja expression to filter the results to show only the MD5 hash values?
{{ [slot 1]|[slot 2] [slot 3].[slot 4] }}
Select the jinja expression in the left column, hold and drag it to a blank position on the right. Place the four correct steps in order, placing the first step in the first slot. Once you place an expression, you can move it again if you want to change your answer before moving to the next question. You need to drop four jinja expressions in the work area.
Select and drag the screen divider to change the viewable area of the source and work areas.

Correct Answer:

Explanation:
Slot 1: vars.artifacts
Slot 2: json_query
Slot 3: ( " data.results[?type== ' FileHash-MD5 ' ]
Slot 4: value
Exact Extract: "You can assign specific fields from your connector action output to their own variables and further manipulate the data using Jinja filters. This approach allows you to efficiently extract, clean, and prepare information for use in later steps of your automation." Exact Extract: The guide shows the same Jinja pattern:
{{ vars.steps.Advanced_Search_Query.data.events | json_query( ' [].attributes.srcIpAddr ' ) | unique }} and explains that similar Jinja logic applies to extracting other variables from structured output.
The correct expression is {{ vars.artifacts | json_query( " data.results[?type== ' FileHash-MD5 ' ].value " ) }} because the JSON object stores artifact records under vars.artifacts.data.results. Each object in results has a type and a value. The filter condition [?type== ' FileHash-MD5 ' ] selects only records whose type is FileHash-MD5 , and .value returns only the MD5 hash strings, not the full objects.
tojson is unnecessary because the data is already structured and queryable. results, data, and value alone are incomplete because they do not filter by artifact type. The key operation is json_query , which uses a JMESPath-style expression to filter a list and project only the required field.
Technical Deep Dive: This is a classic FortiSOAR playbook parsing pattern. Use json_query when the object is already JSON-like and you know the path. The expression returns a list such as:
[ " 6aad63bcc3dd4e148f3724808955f912 " , " 9fd2b1c0e4a37658bca9d0f1e2c34567 " ] This is automation-layer data extraction. FortiGate NP/CP offloading is irrelevant because no packet inspection or firewall data-plane forwarding is involved.