最新なFortinet NSE7_SOC_AR-7.6問題集（93題）、真実試験の問題を全部にカバー！

質問 1：
A large enterprise FortiSIEM deployment is experiencing delays in log correlation and analytics.
Which architectural adjustment is most appropriate? Choose one answer.
A. Add more workers.
B. Increase supervisor CPU and memory.
C. Add more collectors.
D. Limit the number of rules using streaming mode.
正解：A
解説: (Pass4Test メンバーにのみ表示されます)

質問 2：
Refer to the exhibit.

A compromised PC establishes an SSH connection to an engineering build server, which then relays HTTPS traffic to reach servers that would otherwise have blocked access from the LAN. Which technique is used for this attack?
A. Protocol tunneling
B. Exfiltration over C2 channel
C. Port knocking
D. Man-in-the-middle (MITM)
正解：A
解説: (Pass4Test メンバーにのみ表示されます)

質問 3：
You want to use the queue and shift management feature to automatically assign newly created low-priority tasks to members of the L1 queue. However, you are unable to add the Tasks module to the Module Types list. What is the problem? Choose one answer.
A. The Tasks module is not supported by queue and shift management.
B. The Queueable option is disabled for the Tasks module.
C. Shift-based assignment is disabled.
D. There is a higher priority queue for the Tasks module.
正解：B
解説: (Pass4Test メンバーにのみ表示されます)

質問 4：
Which role does a threat hunter play within a SOC?
A. investigate and respond to a reported security incident
B. Collect evidence and determine the impact of a suspected attack
C. Monitor network logs to identify anomalous behavior
D. Search for hidden threats inside a network which may have eluded detection
正解：D
解説: (Pass4Test メンバーにのみ表示されます)

質問 5：
Which two ways can you create an incident on FortiAnalyzer? (Choose two.)
A. Using a custom event handler
B. Using a connector action
C. By running a playbook
D. Manually, on the Event Monitor page
正解：A,D
解説: (Pass4Test メンバーにのみ表示されます)

質問 6：
Refer to the exhibit.

You configured a playbook named False Positive Close , and want to run it to verify if it works. However, when you click Execute and search for the playbook, you do not see it listed. Which two reasons could be the cause of the problem? (Choose two answers)
A. The playbook must first be published using the Application Editor.
B. The manual trigger is configured to require record input to run.
C. Another instance of the playbook is currently executing.
D. The Alerts module is not among the list of modules the playbook can execute on.
正解：B,D
解説: (Pass4Test メンバーにのみ表示されます)

質問 7：
According to the National Institute of Standards and Technology (NIST) cybersecurity framework, incident handling activities can be divided into phases.
In which incident handling phase do you quarantine a compromised host in order to prevent an adversary from using it as a stepping stone to the next phase of an attack?
A. Analysis
B. Eradication
C. Containment
D. Recovery
正解：C
解説: (Pass4Test メンバーにのみ表示されます)

質問 8：
You want to automate a workflow on FortiSOAR so that whenever an incident is moved to the Aftermath phase, it is automatically set to status Resolved and assigned to a purple team specialist as incident lead to write an incident report. In addition, a manual task, assigned to the same specialist, will be created so they are aware of the pending work. Which three steps will accomplish this task? Choose three answers.
A. Create an On Update trigger with a trigger condition that matches the Aftermath phase.
B. Create a Condition step to assign both the incident and task to the specialist.
C. Create an Update Record step to set the incident lead.
D. Create a Find Record step to find matching incidents.
E. Create a Manual Task step to assign the task to the specialist.
正解：A,C,E
解説: (Pass4Test メンバーにのみ表示されます)