FCSS-SOC-AN-7-4 Fortinet FCSS - Security Operations 7.4 Analyst Practice Questions

DNS logs specifically record DNS queries and responses processed by the FortiGate's DNS filter. To find which internal hosts tried to resolve a malicious domain, the analyst should query the DNS logs, filtering for the specific domain name in the 'query' field. This will reveal the source IP addresses of the clients that made the requests.

To generate consolidated reports that include data from multiple devices in a Security Fabric, those devices must be part of a special 'Fabric' type ADOM. This ADOM type enables the FortiAnalyzer to treat the logs from all member devices as a single, unified dataset, allowing for cross-device reporting and analysis.

FortiAnalyzer playbooks can be initiated in three ways: automatically in response to an event handler (Event-based), at a predefined time or interval (Scheduled), or by a SOC analyst on-demand from an incident or event view (Manual). User-based triggers are not a standard type.

Outbreak Alerts are a threat hunting feature linked to FortiGuard Labs. When FortiGuard identifies a new, widespread, and high-risk threat (an 'outbreak'), they can push IOCs to FortiAnalyzer. The Outbreak Alert feature then automatically scans historical logs for these new IOCs, allowing organizations to determine if they were compromised by the threat before it was widely known.

A FortiAnalyzer in Collector mode does not have the analytics engine required to generate reports. Its primary function is to collect and forward logs. All reporting and analysis must be performed on the device in Analyzer mode. To get a report for only the West devices, the administrator would log into the East Analyzer and create a report that includes a device filter for the West FortiGate.

The most effective workflow prioritizes containment. First, quarantine the endpoint to prevent the potential ransomware from spreading (Containment). Second, retrieve the necessary artifact (the process hash) for investigation. Finally, submit the hash to the sandbox for detailed analysis to confirm the threat and inform further response actions. Performing these steps out of order could allow the threat to propagate or lead to analysis of an incorrect artifact.

PsExec operates by creating a temporary Windows service named PSEXESVC on the target machine. Searching for the creation of this service is a primary indicator of PsExec usage. Additionally, monitoring for the execution of the psexec.exe process itself, especially by non-administrative or unexpected user accounts, is a direct way to detect its initiation. The other options are too generic; port 80 traffic is common web traffic, and DNS queries for microsoft.com are normal.

While FortiAnalyzer HA provides redundancy for logging and reporting, it does not support stateful failover for in-flight playbook executions. If the primary unit fails, any playbook currently running will be terminated. Once the secondary unit becomes active, new playbook triggers will be processed, but the state of the previously running playbook is lost.

The successful login from an unexpected foreign IP address represents the adversary gaining a foothold in the network, which maps to the 'Initial Access' tactic. The subsequent creation of a new administrative account is a classic technique for maintaining long-term access, which falls under the 'Persistence' tactic.

Deploying a FortiAnalyzer in collector mode at each store addresses the primary requirement. The collector will receive and store logs locally from the store's devices. This prevents log loss during WAN outages. When the connection is stable, it will reliably forward the stored logs to the central analyzer at HQ for unified analysis and reporting. This distributed model is ideal for environments with unreliable WAN links.