Question 1

Refer to the Exhibit:

An analyst wants to create an incident and generate a report whenever FortiAnalyzer generates a malicious attachment event based on FortiSandbox analysis. The endpoint hosts are protected by FortiClient EMS integrated with FortiSandbox. All devices are logging to FortiAnalyzer. Which connector must the analyst use in this playbook?

Options :

A : FortiSandbox connector

B : FortiClient EMS connector

C : FortiMail connector

D : Local connector

Answer: A

Question 2

Which statement describes automation stitch integration between FortiGate and FortiAnalyzer?

Options :

A : An event handler on FortiAnalyzer executes an automation stitch when an event is created.

B :

An automation stitch is configured on FortiAnalyzer and mapped to FortiGate using the FortiOS connector.

C :

An event handler on FortiAnalyzer is configured to send a notification to FortiGate to trigger an automation stitch.

D : A security profile on FortiGate triggers a violation and FortiGate sends a webhook call to FortiAnalyzer.

Answer: D

Question 3

When does FortiAnalyzer generate an event?

Options :

A : When a log matches a filter in a data selector

B : When a log matches an action in a connector

C : When a log matches a rule in an event handler

D : When a log matches a task in a playbook

Answer: C

Free FCSS_SOC_AN-7.4 Mock Exam – Practice Online Confidently

Buying Options: