NSE7_SOC_AR-7.6 試験問題を無料オンラインアクセス

Refer to the exhibit.

You configured a playbook named False Positive Close , and want to run it to verify if it works. However, when you click Execute and search for the playbook, you do not see it listed. Which two reasons could be the cause of the problem? (Choose two answers)

• A.The playbook must first be published using the Application Editor.
• B.The Alerts module is not among the list of modules the playbook can execute on.
• C.Another instance of the playbook is currently executing.
• D.The manual trigger is configured to require record input to run.

Which two ways can you create an incident on FortiAnalyzer? (Choose two.)

• A.Manually, on the Event Monitor page
• B.Using a custom event handler
• C.By running a playbook
• D.Using a connector action

You are designing a FortiSOAR hybrid multi-tenant deployment. The architecture must support remote tenant execution and automation inside segmented networks. Which three elements are true for this design? Choose three answers.

• A.The FortiSOAR master cluster can host shared tenants, with strict data isolation between them.
• B.Each tenant or agent has a dedicated, access-controlled space on a secure message exchange for message routing.
• C.FortiSOAR tenant nodes or agents use TCP port 5671 to communicate with the secure message exchange.
• D.The secure message exchange must be a dedicated instance instead of an embedded one.
• E.FortiSOAR agents are deployed on the master cluster to improve high availability (HA) performance.

Refer to Exhibit:
A SOC analyst is designing a playbook to filter for a high severity event and attach the event information to an incident.
Which local connector action must the analyst use in this scenario?

• A.Update Asset and Identity
• B.Update Incident
• C.Attach Data to Incident
• D.Get Events

Refer to the exhibits.

How is the investigation and remediation output generated on FortiSIEM? (Choose one answer)

• A.By using FortiAI to summarize the incident
• B.By viewing the Context tab of an incident
• C.By running an incident report
• D.By exporting an incident