NSE 7 - Security Operations 7.6 Architect Practice Questions & Answers • ExamPrepare

Question 1

Refer to the exhibit.

How do you add a piece of evidence to the Action Logs Marked As Evidence area?

By linking an indicator to the war room
By tagging output or a workspace comment with the keyword Evidence
By creating an evidence collection task and attaching a file
By executing a playbook with the Save Execution Logs option enabled

Select an answer above, then submit your vote. Reading or practicing does not cast a vote.

Question 2

A very long FortiSOAR playbook failed at step 30 because of an intermittent networking issue, which has now been resolved. You want to finish executing the playbook without repeating earlier steps or losing prior context.

Which action should you take?

Use the Rerun From Last Failed Step option from the executed playbook logs.
Use mock input for step 30 and re-run the playbook.
Add a connector from the trigger to step 30 directly and re-run the playbook.
Use the Load ENV JSON option in the Jinja Editor and then render the output.

Select an answer above, then submit your vote. Reading or practicing does not cast a vote.

Question 3

Refer to the exhibit. Based on the configuration shown

Refer to the exhibit.

Based on the configuration shown in the exhibit, what are two misconfigurations? (Choose two.)

The time window should be lowered from 900 seconds to reduce false positives.
A logical operator is missing in the SuccessLogin subpattern to evaluate the subpattern relationships.
The SuccessLogin subpattern is not correlated with any FailedLogin or FailedLogin2 attributes.
The subpattern relationships between FailedLogin and FailedLogin2 should be removed.

Select an answer above, then submit your vote. Reading or practicing does not cast a vote.

Question 4

Refer to the exhibits.

You have a playbook that, depending on whether an analyst deems the alert to be a true positive, could reference a child playbook. You need to pass variables from the parent playbook to the child playbook.

Place the steps needed to accomplish this in the correct order.

Select the step in the left column, hold and drag it to a blank position in the column on the right. Place the three correct steps in order, placing the first step in the first position at the top of the column. Once you place a step, you can move it again if you want to change your answer before moving to the next question. You need to drop three steps in the work area.

Select and drag the screen divider to change the viewable area of the source and work areas.

Variables

Step 1

Step 2

Step 3

Question 5

Review the incident report.

An attacker identified employee names, roles, and email patterns from public press releases, which were then used to craft tailored emails. The emails were directed to recipients to review an attached agenda using a link hosted off the corporate domain.

Which two MITRE ATT&CK tactics best fit this report? (Choose two.)

Reconnaissance
Discovery
Initial Access
Defense Evasion

Select an answer above, then submit your vote. Reading or practicing does not cast a vote.

Question 6

Refer to the exhibit.

You created a subpattern to detect at least five failed login attempts from any single user and source IP address to the same network device. However, it is creating more incidents than you had anticipated.

What are the two mistakes in the incident subpattern rule configuration? (Choose two.)

Rule Configuration

The Group By attributes is missing the Source IP field.
The Group By attributes is missing the User field.
The aggregate condition is too restrictive.
The mandatory Event Parser Name attribute is missing.

Select an answer above, then submit your vote. Reading or practicing does not cast a vote.