Fortinet NSE7_SOC_AR-7.6 Exam Dumps

Exact Extract: ''FortiSIEM uses the analytics search filter conditions to create the rule subpattern Filter conditions and the search display conditions to create the rule Group by conditions. When creating rules from analytics searches, FortiSIEM always sets the Aggregate condition to COUNT(Matched Events) >= 1.''

Exact Extract: ''Note that the General and Define Action tabs need manual configuration. Only the Define Condition tab, with the subpattern, is configured for you using the search results. If your search parameters contain multiple rows, all of them will be included in one subpattern.''

The correct answers are C and D. When you create a rule from a FortiSIEM analytics search, FortiSIEM converts the analytics filter rows into the rule's Define Condition logic. If the analytics search contains multiple filter rows, FortiSIEM places them into one subpattern, not multiple independent subpatterns. FortiSIEM also automatically sets the default aggregate to COUNT(Matched Events) >= 1, which means at least one matching event is enough unless you manually adjust the threshold.

Option A is wrong because analytics searches are based on event data, and those search conditions can be used to build a rule. Option B is wrong because the guide is explicit: General and Define Action still require manual configuration. The event type does not automatically configure the incident action.

Exact Extract: ''The first step in creating a queue occurs on the Queue Definition page, where you define a name and description, and specify the modules that you want to associate with the queue... Note that for the module to be selectable under Module Types, you must enable the Queueable setting under Application Editor > Modules.''

The correct answer is A because FortiSOAR only allows a module to appear in the queue Module Types list when that module has the Queueable setting enabled under Application Editor > Modules. The issue is not the task priority or queue priority. A higher priority queue only affects tie-breaking when multiple queues match the same record criteria; it does not prevent a module from being selected. The Tasks module can be used as a FortiSOAR record module, so C is not the best answer. Shift-based assignment is also separate: it controls whether assignment follows shift availability after the queue exists, but it does not control whether the module appears in the Module Types list.

Exact Extract: ''FortiSOAR incident handling phases are closely aligned with NIST incident handling phases... The Post-Incident Activity phase is renamed Aftermath. Functionally, they are identical.''

Exact Extract: ''Use the Update Record step to update a record in a module within FortiSOAR. Use the Find Record step to find a record in a module within FortiSOAR.''

Exact Extract: ''Use the Manual Task step to pause the playbook's execution until you mark the task as skipped or completed.''

The correct answers are C, D, and E. The workflow must start when an existing incident is changed to the Aftermath phase, so the correct trigger is an On Update trigger with a condition that matches the incident phase. After the trigger fires, the incident already exists as the current playbook record, so a Find Record step is unnecessary. To set the incident status to Resolved and assign the purple team specialist as the incident lead, use an Update Record step. To create and assign the follow-up work item, use a Manual Task step assigned to the same specialist.

Option B is wrong because a Condition/Decision step evaluates logic; it does not assign records or create work. Option A is wrong because the playbook is already triggered by the updated incident record, so searching for matching incidents adds unnecessary complexity.

Exact Extract: ''Hybrid tenancy * Some tenants are distributed, but some are shared.'' The guide also states that shared tenancy uses ''one FortiSOAR instance'' for multiple tenants and that ''tenant data is isolated from other tenants through RBAC.''

Exact Extract: ''The master cluster is a hybrid multi-tenant deployment because shared tenants are hosted locally on the cluster, in addition to the remote tenants that communicate through an SME.'' It also states that the SME uses TCP 5671 and that ''each tenant node has a dedicated space with the SME.''

Exact Extract: ''For isolated and segmented networks, you can deploy a FortiSOAR agent to receive and execute connector actions... The agent requires outbound network connectivity only to the SME on TCP port 5671.''

The correct answers are B, C, and D. In a hybrid multi-tenant FortiSOAR design, the master cluster can host local shared tenants while also communicating with remote distributed tenant nodes through the secure message exchange. Shared tenants remain isolated through RBAC, so B is correct. The SME provides controlled message routing, and each tenant node has a dedicated space on the SME, so C is correct. Tenant nodes and agents use TCP 5671 to communicate with the SME, so D is correct. A is wrong because the guide says FortiSOAR can use either the embedded SME or a dedicated external SME; a dedicated SME is recommended for production scalability, but it is not mandatory. E is wrong because agents are deployed in isolated or segmented networks, not on the master cluster for HA performance.

Exact Extract: ''Attribute: Event Type Operator: IN Value: EventTypes: Logon Failure.'' The same section explains that when selecting a group from the CMDB, ''the value displays Group: <Name> when you select the group from CMDB initially.''

The correct answer is B because FortiSIEM uses the IN operator when a search condition references a CMDB group or category. In this case, the value is Group: Logon Success, meaning the query is not matching one literal event type string; it is matching membership in a CMDB event type category. Therefore, the condition should be configured as Event Type IN Group: Logon Success. CONTAIN is for substring matching, such as checking whether a text field contains a word. IS or exact equality-style logic would be appropriate for a single specific value, not a CMDB group. HAS is not the correct operator for matching Event Type membership in a CMDB category.