176 Certification Products • 3429 Comments • 2479 Questions
Refer to the exhibit. What are the two mistakes in the incident subpattern rule configuration?
You want to trigger an incident when multiple failed logins from the same host are followed by a successful login on that same host within 15 minutes. The rule must correlate all events by source IP address and user to ensure they belong to the same login sequence. Which th...
Refer to the exhibit. What can you conclude from the downloaded import report?
Refer to the exhibits. What can you conclude, based on the configuration shown in the exhibit?
What are two benefits of deploying FortiSASE with FortiGate ZTNA access proxy?
You are trying to create a playbook that uses source data from ingestion to populate the description field of a task. You were successful in saving the source data to a variable called ingestion_data. Now, you must parse the results and extract a list of indicators. Which J...
A FortiSOAR playbook includes a Wait step that is configured to pause execution after initiating a reputation lookup on an indicator. Which two configurations of the Wait step are valid?
Refer to the exhibits. You configured the FortiGate connector on FortiSOAR. You want to allow FortiSOAR (10.200.200.160) to perform actions on FortiGate (172.16.200.1). However, the connection attempt fails. Assume that the FortiGate connector is configured correctly on the Fo...
Refer to the exhibit. SMTP Enumeration You are investigating an open incident and want to add records from the Tickets module, a custom module, to the visual correlation widget. Assume there are already linked ticket records to the incident. How do you accomplish this?
You are designing a FortiSOAR hybrid multi-tenant deployment. The architecture must support remote tenant execution and automation inside segmented networks. Which three elements are true for this design?
You are using FortiSIEM analytics to reference the configuration management database (CMDB) event type categories with the following requirements: 1- Attribute: Event Type 2- Value: Group: Logon Success Which operator must you use for the analytics search?
Refer to the exhibit. You are reviewing the Triggering Events page for a FortiSIEM incident. You want to remove the Reporting IP column because you have only one firewall in the topology. How do you accomplish this?
Refer to the exhibit. You must configure the FortiGate connector to allow FortiSOAR to perform actions on a firewall. However, the connection fails. Which two configurations are required?
Refer to the exhibit. A list of FortiSIEM connector actions is shown. You want to create a playbook on FortiSOAR that allows you to accomplish the following: 1- Manually input a range of IP addresses. 2- Use the connector action in the exhibit to retrieve a list of devi...
You have configured FortiSASE Secure Private Access (SPA) deployment. Which statement is true about traffic flows?
Refer to the exhibits. How is the investigation and remediation output generated on FortiSIEM?
Refer to the exhibit. You configured a playbook named False Positive Close, and want to run it to verify if it works. However, when you click Execute and search for the playbook, you do not see it listed. Which two reasons could be the cause of the problem?
Refer to the exhibit. Which method most effectively reduces the attack surface of this organization?
Refer to the exhibit. How do you add a piece of evidence to the Action Logs Marked As Evidence area?
You are troubleshooting an issue where users are being intermittently redirected to an error page after submitting their login credentials on a captive portal. As part of your troubleshooting steps, you review the POST parameters sent from the client to the authentication server....