Manage FortiSOAR Incident Phases NSE6-FORTISOAR-ANALYST Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   What is the purpose of mapping a FortiSOAR incident to MITRE ATT&CK techniques?

   • ATo comply with regulatory requirements for incident reporting
   • BTo automatically remediate the incident without analyst intervention
   • CTo assign a severity score to the incident based on the technique
   • DTo enrich the incident with standardized threat intelligence about adversary behavior
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   An analyst is investigating an incident where an attacker used a spear-phishing email to deliver a malicious macro. The macro then downloaded and executed a remote access tool (RAT). The analyst has mapped the following techniques: T1566.001 (Spearphishing Attachment), T1204.002 (Malicious File), and T1219 (Remote Access Software). The incident is in the 'Investigation' phase. Which of the following is the most important consideration for guiding the next steps?

   • AThe mapped techniques indicate a multi-stage attack, so the investigation should focus on identifying the C2 infrastructure and any data that may have been exfiltrated.
   • BThe incident should be moved to the 'Closure' phase because the techniques have been mapped.
   • CThe investigation should focus on patching the vulnerability that allowed the macro to execute.
   • DThe mapped techniques are sufficient to close the incident, as the attack chain is fully understood.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   An analyst is investigating an incident where a user clicked a malicious link, which downloaded and executed a file. The analyst has mapped the execution to MITRE ATT&CK technique T1204 (User Execution). Which phase of the incident response lifecycle is the analyst most likely in, and what is the primary focus?

   • AInvestigation phase, focusing on identifying the full scope of the execution and its impact.
   • BContainment phase, focusing on blocking the malicious URL.
   • CClosure phase, focusing on writing the final report.
   • DPreparation phase, focusing on updating security awareness training.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A FortiSOAR analyst is analyzing a series of incidents that all involve the use of a common adversary technique. The analyst wants to identify all incidents in the system that are mapped to the same MITRE ATT&CK technique ID to understand the scope of the campaign. How should the analyst accomplish this?

   • AExport all incidents to a CSV file and use a text editor to search for the technique ID.
   • BCreate a new incident and link all other incidents to it as related records.
   • CUse the global search or a saved view to filter incidents by the specific MITRE ATT&CK technique ID.
   • DManually review each incident's notes to find mentions of the technique ID.
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   In FortiSOAR, how does an analyst typically transition an incident from one phase to the next?

   • ABy sending an email to the administrator to request a phase change
   • BBy restarting the FortiSOAR server to reset the phase
   • CBy deleting the incident and recreating it with a new phase
   • DBy manually changing the phase field on the incident record
   Reveal Solution Discussion Select an answer first