Fortinet FCSS - Security Operations 7.4 Analyst Free Sample Questions

The most effective workflow prioritizes containment. First, quarantine the endpoint to prevent the potential ransomware from spreading (Containment). Second, retrieve the necessary artifact (the process hash) for investigation. Finally, submit the hash to the sandbox for detailed analysis to confirm the threat and inform further response actions. Performing these steps out of order could allow the threat to propagate or lead to analysis of an incorrect artifact.

PsExec operates by creating a temporary Windows service named PSEXESVC on the target machine. Searching for the creation of this service is a primary indicator of PsExec usage. Additionally, monitoring for the execution of the psexec.exe process itself, especially by non-administrative or unexpected user accounts, is a direct way to detect its initiation. The other options are too generic; port 80 traffic is common web traffic, and DNS queries for microsoft.com are normal.

While FortiAnalyzer HA provides redundancy for logging and reporting, it does not support stateful failover for in-flight playbook executions. If the primary unit fails, any playbook currently running will be terminated. Once the secondary unit becomes active, new playbook triggers will be processed, but the state of the previously running playbook is lost.

The successful login from an unexpected foreign IP address represents the adversary gaining a foothold in the network, which maps to the 'Initial Access' tactic. The subsequent creation of a new administrative account is a classic technique for maintaining long-term access, which falls under the 'Persistence' tactic.

Deploying a FortiAnalyzer in collector mode at each store addresses the primary requirement. The collector will receive and store logs locally from the store's devices. This prevents log loss during WAN outages. When the connection is stable, it will reliably forward the stored logs to the central analyzer at HQ for unified analysis and reporting. This distributed model is ideal for environments with unreliable WAN links.

The fortiview-cloud-applications-by-user dataset is specifically designed to aggregate traffic data related to cloud application usage and group it by user. This dataset contains the necessary fields, such as user, appcat (application category), and sentbyte or bytes, which are required to filter for 'Cloud.Storage' applications and sum the uploaded data volume per user.

The most precise and effective solution is to add a filter to the event handler's logic. By creating a filter that excludes events where the source IP (srcip) matches the IP of the vulnerability scanner, the handler will ignore this legitimate activity. This allows the handler to remain active and continue monitoring all other sources for the suspicious behavior, effectively tuning out the noise without reducing security visibility.

The fazlic-op-mode command is used in the FortiAnalyzer CLI to switch the device's fundamental operational mode. The two primary modes are 'Analyzer', which provides full analysis, reporting, and SOC features, and 'Collector', which functions as a log aggregation and forwarding point, typically used in distributed logging architectures.

The 'Threat Hunting' view in FortiAnalyzer's FortiSOC module is specifically designed for this purpose. It allows an analyst to search for indicators of compromise (such as file hashes, IPs, or URLs) across all logs from integrated Security Fabric devices. This provides a unified, historical view of the IOC's presence in the network, making it the most efficient method for this type of investigation.

Custom HTTP headers for connectors are defined when the connector itself is configured, not within each playbook that uses it. The correct location is under 'Incidents & Events > Automation > Connectors'. When editing or creating the webhook connector, there is a dedicated section to add custom HTTP headers (key-value pairs) that will be included in every API call made by that connector.