FCSS-SOC-AN-7-4 Sample Questions & Answers

The fortiview-cloud-applications-by-user dataset is specifically designed to aggregate traffic data related to cloud application usage and group it by user. This dataset contains the necessary fields, such as user, appcat (application category), and sentbyte or bytes, which are required to filter for 'Cloud.Storage' applications and sum the uploaded data volume per user.

The most precise and effective solution is to add a filter to the event handler's logic. By creating a filter that excludes events where the source IP (srcip) matches the IP of the vulnerability scanner, the handler will ignore this legitimate activity. This allows the handler to remain active and continue monitoring all other sources for the suspicious behavior, effectively tuning out the noise without reducing security visibility.

The fazlic-op-mode command is used in the FortiAnalyzer CLI to switch the device's fundamental operational mode. The two primary modes are 'Analyzer', which provides full analysis, reporting, and SOC features, and 'Collector', which functions as a log aggregation and forwarding point, typically used in distributed logging architectures.

The 'Threat Hunting' view in FortiAnalyzer's FortiSOC module is specifically designed for this purpose. It allows an analyst to search for indicators of compromise (such as file hashes, IPs, or URLs) across all logs from integrated Security Fabric devices. This provides a unified, historical view of the IOC's presence in the network, making it the most efficient method for this type of investigation.

Custom HTTP headers for connectors are defined when the connector itself is configured, not within each playbook that uses it. The correct location is under 'Incidents & Events > Automation > Connectors'. When editing or creating the webhook connector, there is a dedicated section to add custom HTTP headers (key-value pairs) that will be included in every API call made by that connector.

This solution addresses all requirements. Deploying collectors at each branch ensures logs are stored locally, eliminating loss during network instability (Requirement 1). The collectors can be configured with log forwarding filters to send only high-priority security logs to the central analyzer, reducing WAN traffic (Requirement 2). The central analyzer still receives the critical logs for centralized visibility and analysis (Requirement 3). The entire solution uses FortiAnalyzer collectors, keeping it within the Fortinet ecosystem (Requirement 4).

FortiAnalyzer's primary role is not active blocking but centralized log collection, correlation, and analysis. To identify this behavior, it would ingest process creation logs from an endpoint agent (like FortiClient) showing PowerShell execution, and correlate them with traffic logs from a network device (like FortiGate) showing the resulting connection to the remote server. This correlation provides the full context of the attack.

The sqlplugind process is responsible for handling the log database, including building datasets for reports and FortiView. High CPU usage is often caused by poorly optimized or overly complex custom reports and charts that trigger long-running database queries. The best first step is to use the CLI diagnostic commands (diagnose sql status and diagnose test application sqlplugind) to identify which specific queries are causing the high load, and then optimize the corresponding report or dataset.

Importing a playbook template only adds it to the library of available playbooks. To make it operational, an analyst must create a new playbook from the template, configure its specific trigger conditions (such as linking it to a specific event handler), assign any required connectors, and then explicitly enable it.

Conditional logic in FortiAnalyzer playbooks is implemented using tasks that support branching. An analyst would add a task (often a 'Condition' or 'Branch' task type) that evaluates a variable from the incoming incident, such as incident.severity. Based on the value of this variable, the playbook execution will follow a different path or 'branch', allowing for different sets of subsequent tasks to be executed.