Manage FortiSOAR Incident Phases NSE6-FORTISOAR-ANALYST Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   How can an analyst use MITRE ATT&CK within FortiSOAR to guide incident response actions?

   • ABy calculating the financial impact of the incident
   • BBy determining the legal jurisdiction of the incident
   • CBy automatically blocking all IP addresses associated with the incident
   • DBy identifying the techniques used and referencing recommended mitigations and detections
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   An analyst is investigating an incident where an attacker exploited a vulnerability in a web application to gain access to a database. The analyst has mapped the initial access to T1190 (Exploit Public-Facing Application) and the data access to T1213 (Data from Information Repositories). The incident is in the 'Investigation' phase. The analyst needs to determine the most likely next step of the adversary. Based on the MITRE ATT&CK framework, which technique should the analyst look for next?

   • AT1078 (Valid Accounts), as the adversary will likely create a new account for persistence.
   • BT1041 (Exfiltration Over C2 Channel), as the adversary has likely achieved their goal of data theft.
   • CT1059 (Command and Scripting Interpreter), as the adversary will likely use a shell to explore the network.
   • DT1485 (Data Destruction), as the adversary will likely destroy the data to cover their tracks.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A security analyst is investigating a ransomware incident in FortiSOAR. The analyst has mapped the attack to MITRE ATT&CK technique T1486 (Data Encrypted for Impact). Based on this mapping, which response action should the analyst prioritize to guide the incident response?

   • AImmediately delete all user accounts to prevent lateral movement.
   • BReboot all servers to clear the ransomware from memory.
   • CDisable the firewall to allow the ransomware to communicate with its C2 server for decryption.
   • DIsolate the affected endpoints from the network to prevent further encryption.
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   What is the primary purpose of the 'Closure' phase in the FortiSOAR incident lifecycle?

   • ATo collect and preserve evidence for potential legal proceedings
   • BTo document the final resolution, lessons learned, and formally end the incident
   • CTo perform the initial assessment and assign a priority to the incident
   • DTo execute containment and eradication actions against the threat
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   During an incident investigation, a FortiSOAR analyst identifies that a threat actor used PowerShell to execute a malicious script. The analyst wants to enrich the incident record with the specific MITRE ATT&CK technique ID for 'PowerShell' execution to aid in further analysis and reporting. In FortiSOAR, where should the analyst look to add this mapping?

   • AIn the 'Indicators' section, change the indicator type to 'MITRE ATT&CK' and set the value to 'T1059.001'.
   • BIn the 'Tasks' section, create a new task named 'T1059.001' and assign it to the lead analyst.
   • CIn the 'MITRE ATT&CK' related tab or widget on the incident detail page, associate the technique T1059.001.
   • DIn the 'Notes' section, add a free-text note stating 'Used T1059.001'.
   Reveal Solution Discussion Select an answer first