FCSS_SOC_AN-7.4 Practice Test

Review 27 FCSS-SOC-AN-7-4 practice questions with answer explanations and community insights.

Question 1

According to the National Institute of Standards and Technology (NIST) cybersecurity framework, incident handling activities can be divided into phases. In which incident handling phase do you quarantine a compromised host in order to prevent an adversary from using it as a stepping stone to the next phase of an attack?

  1. Containment
  2. Recovery
  3. Analysis
  4. Eradication

Question 2

Refer to the exhibit. You are tasked with reviewing a new FortiAnalyzer deployment in a network with multiple registered logging devices. There is only one FortiAnalyzer in the topology. Which potential problem do you observe?

  1. The archive retention period is too long.
  2. The analytics-to-archive ratio is misconfigured.
  3. The disk space allocated is insufficient.
  4. The analytics retention period is too long.

Question 3

While monitoring your network, you discover that one FortiGate device is sending significantly more logs to FortiAnalyzer than all of the other FortiGate devices in the topology. Additionally, the ADOM that the FortiGate devices are registered to consistently exceeds its quota. What are two possible solutions? (Choose two.)

  1. Reconfigure the first FortiGate device to reduce the number of logs it forwards to FortiAnalyzer.
  2. Increase the storage space quota for the first FortiGate device.
  3. Configure data selectors to filter the data sent by the first FortiGate device.
  4. Create a separate ADOM for the first FortiGate device and configure a different set of storage policies.

Question 4

Which role does a threat hunter play within a SOC?

  1. Investigate and respond to a reported security incident
  2. Monitor network logs to identify anomalous behavior
  3. Collect evidence and determine the impact of a suspected attack
  4. Search for hidden threats inside a network which may have eluded detection

Question 5

Which two statements about the FortiAnalyzer Fabric topology are true? (Choose two.)

  1. The supervisor uses an API to store logs, incidents, and events locally.
  2. Downstream collectors can forward logs to Fabric members.
  3. Logging devices must be registered to the supervisor.
  4. Fabric members must be in analyzer mode.