NSE7_SOC_AR-7.6 Practice Questions

Exact Extract: “The Pyramid of Pain illustrates why focusing on adversary TTPs is important: They are the most descriptive IOCs of a given adversary and the toughest for threat actors to change.” The guide ranks Domain Names as “Simple” and IP Addresses as “Easy,” while TTPs are “Tough.”

Exact Extract: “As you progress from the top of the pyramid to the bottom, the disruption of an element becomes easier for the adversary to recover from… once those IP addresses start to be widely recognized as malicious and potentially blocked, it is easy for the attacker to start using other IP addresses.”

The correct answers are C and D . Blocking IP addresses and domains is useful, but it targets low-level observable indicators, not the adversary’s deeper behavior. In the Pyramid of Pain, IP addresses and domain names sit near the bottom because attackers can replace them quickly by rotating infrastructure, registering new domains, using compromised hosts, or changing hosting providers. Therefore, this approach focuses on network indicators and creates only limited disruption.

Option A is too strong. IPs and domains may reveal infrastructure, but blocking them does not necessarily identify strategic weaknesses in the adversary’s operation. Option B is wrong because high operational cost is associated with forcing adversaries to change tools or TTPs, not merely rotating IPs and domains.

Technical Deep Dive: In a Fortinet SOC, blocking phishing IPs/domains can be automated through FortiSOAR playbooks using FortiGate address objects, DNS filtering, FortiMail blocklists, or FortiGuard threat intelligence enrichment. That is good hygiene, but it is reactive. Higher-value hunting looks for reusable phishing tradecraft: lure themes, sender infrastructure patterns, attachment behaviors, command-and-control sequence, credential collection workflow, and post-compromise TTPs. ASIC offloading is not the key issue here; the security value comes from intelligence quality and detection depth, not packet acceleration.

Exact Extract: “Use the Wait step to specify the time that the playbook should wait after a specific step before continuing with the remaining steps in the playbook. Alternatively, specify the conditions that must be met before the playbook continues. For example, investigation playbooks should wait for enrichment to finish before continuing with the subsequent steps.”

The correct answers are A and B . A Wait step can resume after a defined duration, so option A is valid. It can also resume when a condition is met, such as the indicator record being updated after the reputation lookup or enrichment process completes, so option B is also valid. Option C is not a Wait-step function; retrying failed actions at intervals belongs to step execution/error-handling behavior, not the Wait step’s purpose. Option D is also wrong because executing another playbook is handled by a separate reference/playbook execution step, not by the Wait step while it is paused. The guide separately identifies “Reference a Playbook” as the step used to execute another playbook.

Technical Deep Dive: In FortiSOAR playbooks, Wait is a control-flow gate. Use time-based waiting when an external system has predictable processing latency, for example waiting 60 seconds after submitting an IOC to a sandbox or reputation service. Use condition-based waiting when the downstream update is asynchronous, for example waiting until an indicator’s reputation, enrichment status, or related field changes. This prevents the playbook from reading incomplete enrichment data. This is SOAR workflow orchestration; FortiGate NP/CP hardware offloading is irrelevant because no traffic forwarding, session acceleration, or content processor inspection is involved.

Slot 1: vars.artifacts

Slot 2: json_query

Slot 3: ( " data.results[?type== ' FileHash-MD5 ' ]

Slot 4: value

Exact Extract: “You can assign specific fields from your connector action output to their own variables and further manipulate the data using Jinja filters. This approach allows you to efficiently extract, clean, and prepare information for use in later steps of your automation.”

Exact Extract: The guide shows the same Jinja pattern:

{{ vars.steps.Advanced_Search_Query.data.events | json_query( ' [].attributes.srcIpAddr ' ) | unique }}

and explains that similar Jinja logic applies to extracting other variables from structured output.

The correct expression is {{ vars.artifacts | json_query( " data.results[?type== ' FileHash-MD5 ' ].value " ) }} because the JSON object stores artifact records under vars.artifacts.data.results. Each object in results has a type and a value. The filter condition [?type== ' FileHash-MD5 ' ] selects only records whose type is FileHash-MD5 , and .value returns only the MD5 hash strings, not the full objects.

tojson is unnecessary because the data is already structured and queryable. results, data, and value alone are incomplete because they do not filter by artifact type. The key operation is json_query , which uses a JMESPath-style expression to filter a list and project only the required field.

Technical Deep Dive: This is a classic FortiSOAR playbook parsing pattern. Use json_query when the object is already JSON-like and you know the path. The expression returns a list such as:

[ " 6aad63bcc3dd4e148f3724808955f912 " , " 9fd2b1c0e4a37658bca9d0f1e2c34567 " ]

This is automation-layer data extraction. FortiGate NP/CP offloading is irrelevant because no packet inspection or firewall data-plane forwarding is involved.

Overview of Indicators of Compromise (IoCs) : Indicators of Compromise (IoCs) are pieces of evidence that suggest a system may have been compromised. These can include unusual network traffic patterns, the presence of known malicious files, or other suspicious activities.

FortiAnalyzer ' s Role : FortiAnalyzer aggregates logs from various Fortinet devices to provide comprehensive visibility and analysis of network events. It uses these logs to identify potential IoCs and compromised hosts.

Relevant Log Types :

DNS Filter Logs :

DNS requests are a common vector for malware communication. Analyzing DNS filter logs helps in identifying suspicious domain queries, which can indicate malware attempting to communicate with command and control (C2) servers.

In FortiSOAR 7.6 , manual playbooks appear in the Execute menu of a record only if they meet specific configuration criteria defined in the Manual Trigger step:

Module Scope (C): When creating a playbook with a manual trigger, the administrator must explicitly select which modules (e.g., Alerts, Incidents, Indicators) can execute the playbook. If the Alerts module is not selected in the " Applicable Modules " section of the trigger configuration, the playbook will remain hidden from the Execute menu when an analyst is viewing the Alerts module.

Trigger Execution Requirements (D): Manual triggers can be configured to execute on no records , a single record , or multiple records . If a playbook is configured with the " Requires record input to run " setting but is specifically restricted to a different input type (or if there is a mismatch in the selection logic), it will not appear in the menu unless the correct number of records are selected. Furthermore, if a playbook is designed to run only when no record is selected (global utility), it will not show up in the context-sensitive menu of a specific record.

Why other options are incorrect:

Publishing (A): FortiSOAR playbooks do not require a separate " publishing " step via an Application Editor to become visible. Once they are saved and active (toggled on), they are immediately available for use based on their trigger settings.

Concurrent Execution (B): FortiSOAR allows multiple instances of the same playbook to run simultaneously. An active execution of a playbook does not hide it from the menu for other analysts or subsequent runs.