[Oct-2026] NSE7_SOC_AR-7.6 Exam Dumps, NSE7_SOC_AR-7.6 Practice Test Questions [Q12-Q27]

Rate this post

[Oct-2026] NSE7_SOC_AR-7.6 Exam Dumps, NSE7_SOC_AR-7.6 Practice Test Questions

Attested NSE7_SOC_AR-7.6 Dumps PDF Resource [2026]

QUESTION 12
A customer wants FortiAnalyzer to run an automation stitch that executes a CLI command on FortiGate to block a predefined list of URLs, if a botnet command-and-control (C&C) server IP is detected.
Which FortiAnalyzer feature must you use to start this automation process?

Playbook

Data selector

Event handler

Connector

QUESTION 13
Refer to the exhibit.

You are trying to find traffic flows to destinations that are in Europe or Asia, for hosts in the local LAN segment. However, the query returns no results. Assume these logs exist on FortiSIEM.
Which three mistakes can you see in the query shown in the exhibit? (Choose three answers)

The null value cannot be used with the IS NOT operator.

The time range must be Absolute for queries that use configuration management database (CMDB) groups.

There are missing parentheses between the first row (Group: Europe) and the second row (Group: Asia).

The Source IP row operator must be BETWEEN 10.0.0.0, 10.200.200.254.

The logical operator for the first row (Group: Europe) must be OR.

QUESTION 14
Review the following incident report:
Attackers leveraged a phishing email campaign targeting your employees.
The email likely impersonated a trusted source, such as the IT department, and requested login credentials.
An unsuspecting employee clicked a malicious link in the email, leading to the download and execution of a Remote Access Trojan (RAT).
The RAT provided the attackers with remote access and a foothold in the compromised system.
Which two MITRE ATT&CK tactics does this incident report capture? (Choose two.)

Initial Access

Defense Evasion

Lateral Movement

Persistence

QUESTION 15
You are using FortiSIEM analytics to reference the configuration management database (CMDB) event type categories with the following requirements:
* Attribute: Event Type
* Value: Group: Logon Success
Which operator must you use for the analytics search? Choose one answer.

CONTAIN

HAS

QUESTION 16
Which statement describes automation stitch integration between FortiGate and FortiAnalyzer?

An event handler on FortiAnalyzer executes an automation stitch when an event is created.

An automation stitch is configured on FortiAnalyzer and mapped to FortiGate using the FortiOS connector.

An event handler on FortiAnalyzer is configured to send a notification to FortiGate to trigger an automation stitch.

A security profile on FortiGate triggers a violation and FortiGate sends a webhook call to FortiAnalyzer.

* Overview of Automation Stitches: Automation stitches in Fortinet solutions enable automated responses to specific events detected within the network. This automation helps in swiftly mitigating threats without manual intervention.
* FortiGate Security Profiles:
* FortiGate uses security profiles to enforce policies on network traffic. These profiles can include antivirus, web filtering, intrusion prevention, and more.
* When a security profile detects a violation or a specific event, it can trigger predefined actions.
* Webhook Calls:
* FortiGate can be configured to send webhook calls upon detecting specific security events.
* A webhook is an HTTP callback triggered by an event, sending data to a specified URL. This allows FortiGate to communicate with other systems, such as FortiAnalyzer.
* FortiAnalyzer Integration:
* FortiAnalyzer collects logs and events from various Fortinet devices, providing centralized logging and analysis.
* Upon receiving a webhook call from FortiGate, FortiAnalyzer can further analyze the event, generate reports, and take automated actions if configured to do so.
* Detailed Process:
* Step 1: A security profile on FortiGate triggers a violation based on the defined security policies.
* Step 2: FortiGate sends a webhook call to FortiAnalyzer with details of the violation.
* Step 3: FortiAnalyzer receives the webhook call and logs the event.
* Step 4: Depending on the configuration, FortiAnalyzer can execute an automation stitch to respond to the event, such as sending alerts, generating reports, or triggering further actions.
Fortinet Documentation: FortiOS Automation Stitches
FortiAnalyzer Administration Guide: Details on configuring event handlers and integrating with FortiGate.
FortiGate Administration Guide: Information on security profiles and webhook configurations.
By understanding the interaction between FortiGate and FortiAnalyzer through webhook calls and automation stitches, security operations can ensure a proactive and efficient response to security events.

QUESTION 17
You created a war room and want to run a connector action to look up the reputation of a domain.
Then, you need to save the output for your team to review. However, there is a lot of output, and you want to limit the amount of information attached to the war room. How do you accomplish this?
Choose one answer.

From the returned output, select only the output keys you want.

Apply a workspace filter to show only relevant fields.

Use the Investigate tab to map only the fields you want.

Lower the playbook logging level before executing the connector.

QUESTION 18
Refer to the exhibit.
Assume that all devices in the FortiAnalyzer Fabric are shown in the image.
Which two statements about the FortiAnalyzer Fabric deployment are true? (Choose two.)

FortiGate-B1 and FortiGate-B2 are in a Security Fabric.

There is no collector in the topology.

All FortiGate devices are directly registered to the supervisor.

FAZ-SiteA has two ADOMs enabled.

QUESTION 19
Refer to the exhibit.

You notice that the custom event handler you configured to detect SMTP reconnaissance activities is creating a large number of events. This is overwhelming your notification system.
How can you fix this?

Disable the custom event handler because it is not working as expected.

Increase the log field value so that it looks for more unique field values when it creates the event.

Decrease the time range that the custom event handler covers during the attack.

Increase the trigger count so that it identifies and reduces the count triggered by a particular group.

QUESTION 20
When configuring a FortiAnalyzer to act as a collector device, which two steps must you perform? (Choose two.)

Enable log compression.

Configure log forwarding to a FortiAnalyzer in analyzer mode.

Configure the data policy to focus on archiving.

Configure Fabric authorization on the connecting interface.

QUESTION 21
Your company is doing a security audit To pass the audit, you must take an inventory of all software and applications running on all Windows devices Which FortiAnalyzer connector must you use?

FortiClient EMS

ServiceNow

FortiCASB

Local Host

QUESTION 22
Refer to the exhibit.

The input of a FortiSIEM connector action is shown.
You want to create a playbook on FortiSOAR that allows you to accomplish the following:
Manually input an IP address.
Use the connector action in the exhibit to retrieve a device from the FortiSIEM configuration management database (CMDB) with that IP address.
Ask the SOC manager to review the information pulled from FortiSIEM about that device.
If the manager approves, an asset record is created.
Which combination and order of step operations fulfills the requirements with the fewest required playbook steps?

Manual trigger, 2) Connector action, 3) Approval, 4) Create Record

Manual trigger, 2) Set Variable, 3) Connector action, 4) Set Variable, 5) Approval, 6) Create record

On Create trigger, 2) Connector action, 3) Manual Task, 4) Create record

Connector action, 2) Approval, 3) Create record, 4) Update record

Exact Extract: “This playbook also expects input from the user, specifically an IP address… you can manually type in an IP address. The trigger input is saved as ipAddress, which you can refer to later as a dynamic value.” Exact Extract: “The connector must first be configured… The selected action is Get IP Reputation… The Get IP Reputation action requires input. In the trigger step, you defined the ipAddress parameter from the trigger input, which you can dynamically map to this step.” Exact Extract: “After the Connector step is the Approval step. You can manually add a description, or you can use the Dynamic Values window to populate fields such as the Description field.” The correct answer is A . The workflow requires analyst-supplied input, so it must begin with a Manual trigger where the IP address is entered. That IP address is passed directly into the FortiSIEM Get Device Information connector action. The output from that connector action is then shown to the SOC manager through an Approval step. If approved, the playbook proceeds to Create Record , creating the asset record from the FortiSIEM CMDB result.
Option B is bloated. Set Variable steps are not required because the manual trigger value and connector output can be referenced directly through Dynamic Values/Jinja. Option C is wrong because On Create is event- driven, not manual input, and Manual Task does not provide the same approve/reject workflow as an Approval step. Option D is wrong because it lacks the manual trigger and adds an unnecessary Update Record step.
Technical Deep Dive: The clean FortiSOAR pattern is Manual Input # External Lookup # Human Approval # Record Creation. In implementation, the manual trigger captures device_ip, the FortiSIEM connector action maps that value to Device IP, the Approval step displays key returned fields such as hostname, IP, organization, device type, and CMDB attributes, and the Create Record step maps the approved output into the Assets module. This is SOAR workflow orchestration; FortiGate NP/CP hardware offload is irrelevant because no traffic forwarding or ASIC inspection path is involved.

QUESTION 23
Which two ways can you create an incident on FortiAnalyzer? (Choose two answers)

Using a custom event handler

Using a connector action

Manually, on the Event Monitor page

By running a playbook

QUESTION 24
You suspect your organization has been a victim of numerous incidents carried out by the same threat actor.
Which option allows you to group the incidents and track them? Choose one answer.

Add a common tag to correlate them.

Mark one incident as the parent and run a playbook to close the child incidents.

Select those incidents and use the Merge function.

Create a campaign and link related records to it.

QUESTION 25
Which three are threat hunting activities? (Choose three answers)

Enrich records with threat intelligence.

Automate workflows.

Generate a hypothesis.

Perform packet analysis.

Tune correlation rules.

According to the specialized threat hunting modules and frameworks within FortiSOAR 7.6 and the advanced analytics capabilities of FortiSIEM 7.3 , threat hunting is defined as a proactive, human-led search for threats that have bypassed automated security controls. The three selected activities are core components of this lifecycle:
* Generate a hypothesis (C): This is the fundamental starting point of a ” Structured Hunt. ” Analysts develop a testable theory-based on recent threat intelligence (such as a new TTP identified by FortiGuard) or environmental risk-about how an attacker might be operating undetected in the network.
* Enrich records with threat intelligence (A): During the investigation phase, hunters use the Threat Intelligence Management (TIM) module in FortiSOAR to enrich technical data (IPs, hashes, URLs) with external context. This helps determine if an anomaly discovered during the hunt is indeed malicious or part of a known campaign.
* Perform packet analysis (D): Since advanced threats often live in the ” gaps ” between log files, hunters frequently perform deep-packet or network-flow analysis using FortiSIEM’s query tools or integrated NDR (Network Detection and Response) data to identify suspicious lateral movement or C2 (Command and Control) communication patterns that standard alerts might miss.
Why other options are excluded:
* Automate workflows (B): While SOAR is designed for automation, the act of ” automating ” is a DevOps or SOC engineering task. Threat hunting itself is a proactive investigation; while playbooks can assist a hunter (e.g., by automating the data gathering), the act of hunting remains a manual or semi- automated cognitive process.
* Tune correlation rules (E): Tuning rules is a reactive maintenance task or a ” post-hunt ” activity.
Once a threat hunter finds a new attack pattern, they will then tune SIEM correlation rules to ensure that specific threat is detected automatically in the future. The tuning is the result of the hunt, not the activity of hunting itself.

QUESTION 26
Refer to the exhibit. What is the correct Jinja expression to filter the results to show only the MD5 hash values?
{{ [slot 1] | [slot 2] [slot 3].[slot 4] }}
Select the Jinja expression in the left column, hold and drag it to a blank position on the right. Place the four correct steps in order, placing the first step in the first slot.

QUESTION 27
A large enterprise FortiSIEM deployment is experiencing delays in log correlation and analytics.
Which architectural adjustment is most appropriate? Choose one answer.

Limit the number of rules using streaming mode.

Add more workers.

Add more collectors.

Increase supervisor CPU and memory.

Fortinet NSE7_SOC_AR-7.6 Exam Syllabus Topics:

Topic	Details
Topic 1	SOAR Playbook Development: Covers configuring playbooks and connectors, using Jinja filters for data handling, and troubleshooting FortiSOAR automation workflows.
Topic 2	SOAR Incident Handling and Threat Hunting: Includes threat hunting analysis, managing FortiSOAR incidents, workload coordination, and using war rooms for incident response.
Topic 3	Detection Capabilities: Focuses on configuring FortiSIEM incident rules, building log queries, and analyzing incidents for effective threat detection.
Topic 4	SOC Concepts and Frameworks: Covers analyzing security incidents, identifying adversary behaviors, understanding Fortinet SOC architecture, and recognizing common attack vectors.