FCSS_SOC_AN-7.4 : BUNDLE PACK LEARNING TOOLS INCLUDED

Description
The FCSS in Security Operations certification validates your ability to design, administer, monitor, and troubleshoot Fortinet security operations solutions. This curriculum covers security operations infrastructures using advanced Fortinet solutions.

Who Should Attempt the FCSS in Security Operations Certification?
We recommend this certification for cybersecurity professionals who require the expertise needed to design, manage, support, and analyze advanced Fortinet security operations solutions.

Program Requirements
To achieve this certification, you are required to pass one elective exam.

Core Exams  N/A
Elective Exams
FCSS - Advanced Analytics Architect
FCSS - Security Operations Analyst

To prepare for the certification exam, we recommend that you take the associated NSE course.

Digital Badges
You will receive Digital badges under the following circumstances:

Exam badge: Each time you pass any version of the exam included in FCSS - Security Operations.
Certification badge: Once you achieve the requirement for the FCSS - Security Operations certification.
For more information, see the following knowledge base article in the Fortinet Training Institute Helpdesk.

About the FCSS in Security Operations Exams
Exams available at Pearson VUE.
FCSS—Advanced Analytics 6.7 Architect
FCSS—Security Operations 7.4 Analyst

Exam series: FCSS_SOC_AN-7.4
Number of questions: 32
Exam time: 65 minutes
Language: English
Product version: FortiAnalyzer 7.4, FortiOS 7.4
Status: Available
Exam details: exam description

Certification
This exam is part of the Fortinet Certified Solution Specialist - Security Operations certification track.
This certification validates your ability to design, administer, monitor, and troubleshoot Fortinet security operations solutions.
This curriculum covers security operations infrastructures using advanced Fortinet solutions.

Visit the Cybersecurity Certification page for information about certification requirements.

Exam
The FCSS - Security Operations 7.4 Analyst exam evaluates your knowledge and skills in designing, deploying, and managing a
Fortinet SOC solution using advanced FortiAnalyzer features and functions to detect, investigate, and respond to cyberthreats.
This exam tests your knowledge and skills related to configuring FortiAnalyzer SOC features and functions, various FortiAnalyzer
deployment architectures, incident handling and analysis, and automation.
Once you pass the exam, you will receive the following exam badge:

Exam Details
Exam name FCSS - Security Operations 7.4 Analyst
Exam series FCSS_SOC_AN-7.4
Time allowed 65 minutes
Exam questions 32 multiple-choice questions
Scoring Pass or fail. A score report is available from your Pearson VUE account.
Language English
Product version FortiAnalyzer 7.4, FortiOS 7.4

Exam Topics
Successful candidates have applied knowledge and skills in the following areas and tasks:
* SOC concepts and adversary behavior
* Analyze security incidents and identify adversary behaviors
* Map adversary behaviors to MITRE ATT&CK tactics and techniques
* Identify components of the Fortinet SOC solution
* Architecture and detection capabilities
* Configure and manage collectors and analyzers
* Design stable and efficient FortiAnalyzer deployments
* Design, configure, and manage FortiAnalyzer Fabric deployments
* SOC operation
* Configure and manage event handlers
* Analyze and manage events and incidents
* Analyze threat hunting information feeds
* Manage outbreak alert handlers and reports
* SOC automation
* Configure playbook triggers and tasks
* Configure and manage connectors
* Manage playbook templates
* Monitor playbooks

Training Resources
The following resources are recommended for attaining the knowledge and skills that are covered on the exam.
The recommended training is available as a foundation for exam preparation. In addition to training, you are strongly encouraged to have hands-on experience with the exam topics and objectives.
* FCSS - Security Operations 7.4 Analyst course and hands-on labs
* FortiAnalyzer 7.4—Administration Guide
* FortiAnalyzer 7.4—Fabric Deployment Guide
* FortiAnalyzer 7.4—Examples Guide
* FortiAnalyzer—Playbook Variables Guide
* FortiAnalyzer—Architecture Guide

Experience
* 1 year of experience with network security
* 6 months of experience working in SOC

Exam Sample Questions
A set of sample questions is available from the Fortinet Training Institute. These questions represent the exam content in
question type and content scope. However, the questions do not necessarily represent all the exam content, nor are they
intended to assess your readiness to take the certification exam.

See the Fortinet Training Institute for the course that includes the sample questions.

Examination Policies and Procedures
The Fortinet Training Institute recommends that you review the exam policies and procedures before you register for the exam.
Access important information on the Fortinet Training Institute Policies page, and find answers to common questions on the FAQ page.

Questions?
If you have more questions about the NSE Certification Program, contact us through the Fortinet Training Institute Helpdesk page.

Sample Question and Answers

QUESTION 1
Which statement describes automation stitch integration between FortiGate and FortiAnalyzer?

A. An event handler on FortiAnalyzer executes an automation stitch when an event is created.
B. An automation stitch is configured on FortiAnalyzer and mapped to FortiGate using the FortiOS connector.
C. An event handler on FortiAnalyzer is configured to send a notification to FortiGate to trigger an automation stitch.
D. A security profile on FortiGate triggers a violation and FortiGate sends a webhook call to FortiAnalyzer.

Answer: D

Explanation:
Overview of Automation Stitches: Automation stitches in Fortinet solutions enable automated
responses to specific events detected within the network. This automation helps in swiftly mitigating
threats without manual intervention.
FortiGate Security Profiles:
FortiGate uses security profiles to enforce policies on network traffic. These profiles can include
antivirus, web filtering, intrusion prevention, and more.
When a security profile detects a violation or a specific event, it can trigger predefined actions.
Webhook Calls:
FortiGate can be configured to send webhook calls upon detecting specific security events.
A webhook is an HTTP callback triggered by an event, sending data to a specified URL. This allows
FortiGate to communicate with other systems, such as FortiAnalyzer.
FortiAnalyzer Integration:
FortiAnalyzer collects logs and events from various Fortinet devices, providing centralized logging
and analysis.
Upon receiving a webhook call from FortiGate, FortiAnalyzer can further analyze the event, generate
reports, and take automated actions if configured to do so.
Detailed Process:
Step 1: A security profile on FortiGate triggers a violation based on the defined security policies.
Step 2: FortiGate sends a webhook call to FortiAnalyzer with details of the violation.
Step 3: FortiAnalyzer receives the webhook call and logs the event.
Step 4: Depending on the configuration, FortiAnalyzer can execute an automation stitch to respond
to the event, such as sending alerts, generating reports, or triggering further actions.
Reference:
Fortinet Documentation: FortiOS Automation Stitches
FortiAnalyzer Administration Guide: Details on configuring event handlers and integrating with FortiGate.
FortiGate Administration Guide: Information on security profiles and webhook configurations.
By understanding the interaction between FortiGate and FortiAnalyzer through webhook calls and
automation stitches, security operations can ensure a proactive and efficient response to security events.

QUESTION 2
Which three end user logs does FortiAnalyzer use to identify possible IOC compromised hosts?
(Choose three.)

A. Email filter logs
B. DNS filter logs
C. Application filter logs
D. IPS logs
E. Web filter logs

Answer: BDE

Explanation:
Overview of Indicators of Compromise (IoCs): Indicators of Compromise (IoCs) are pieces of evidence
that suggest a system may have been compromised. These can include unusual network traffic
patterns, the presence of known malicious files, or other suspicious activities.
FortiAnalyzer's Role: FortiAnalyzer aggregates logs from various Fortinet devices to provide
comprehensive visibility and analysis of network events. It uses these logs to identify potential IoCs
and compromised hosts.
Relevant Log Types:
DNS Filter Logs:
DNS requests are a common vector for malware communication. Analyzing DNS filter logs helps in
identifying suspicious domain queries, which can indicate malware attempting to communicate with
command and control (C2) servers.
Reference: Fortinet Documentation on DNS Filtering FortiOS DNS Filter IPS Logs:
Intrusion Prevention System (IPS) logs detect and block exploit attempts and malicious activities.
These logs are critical for identifying compromised hosts based on detected intrusion attempts or
behaviors matching known attack patterns.
Reference: Fortinet IPS Overview FortiOS IPS
Web Filter Logs:
Web filtering logs monitor and control access to web content. These logs can reveal access to
malicious websites, download of malware, or other web-based threats, indicating a compromised host.
Reference: Fortinet Web Filtering FortiOS Web Filter
Why Not Other Log Types:
Email Filter Logs:
While important for detecting phishing and email-based threats, they are not as directly indicative of
compromised hosts as DNS, IPS, and Web filter logs.
Application Filter Logs:
These logs control application usage but are less likely to directly indicate compromised hosts
compared to the selected logs.
Detailed Process:
Step 1: FortiAnalyzer collects logs from FortiGate and other Fortinet devices.
Step 2: DNS filter logs are analyzed to detect unusual or malicious domain queries.
Step 3: IPS logs are reviewed for any intrusion attempts or suspicious activities.
Step 4: Web filter logs are checked for access to malicious websites or downloads.
Step 5: FortiAnalyzer correlates the information from these logs to identify potential IoCs and
compromised hosts.
Reference:
Fortinet Documentation: FortiOS DNS Filter, IPS, and Web Filter administration guides.
FortiAnalyzer Administration Guide: Details on log analysis and IoC identification.
By using DNS filter logs, IPS logs, and Web filter logs, FortiAnalyzer effectively identifies possible
compromised hosts, providing critical insights for threat detection and response.

QUESTION 3
Which role does a threat hunter play within a SOC?

A. investigate and respond to a reported security incident
B. Collect evidence and determine the impact of a suspected attack
C. Search for hidden threats inside a network which may have eluded detection
D. Monitor network logs to identify anomalous behavior

Answer: C

Explanation:
Role of a Threat Hunter:
A threat hunter proactively searches for cyber threats that have evaded traditional security defenses.
This role is crucial in identifying sophisticated and stealthy adversaries that bypass automated
detection systems.
Key Responsibilities:
Proactive Threat Identification:
Threat hunters use advanced tools and techniques to identify hidden threats within the network.
This includes analyzing anomalies, investigating unusual behaviors, and utilizing threat intelligence.
Reference: SANS Institute, "Threat Hunting: Open Season on the Adversary" SANS Threat Hunting
Understanding the Threat Landscape:
They need a deep understanding of the threat landscape, including common and emerging tactics,
techniques, and procedures (TTPs) used by threat actors.
Reference: MITRE ATT&CK Framework MITRE ATT&CK
Advanced Analytical Skills:
Utilizing advanced analytical skills and tools, threat hunters analyze logs, network traffic, and
endpoint data to uncover signs of compromise.
Reference: Cybersecurity and Infrastructure Security Agency (CISA) Threat Hunting Guide CISA Threat Hunting
Distinguishing from Other Roles:
Investigate and Respond to Incidents (A):
This is typically the role of an Incident Responder who reacts to reported incidents, collects evidence,
and determines the impact.
Reference: NIST Special Publication 800-61, "Computer Security Incident Handling Guide" NIST
Incident Handling
Collect Evidence and Determine Impact (B):
This is often the role of a Digital Forensics Analyst who focuses on evidence collection and impact
assessment post-incident.
Monitor Network Logs (D):
This falls under the responsibilities of a SOC Analyst who monitors logs and alerts for anomalous
behavior and initial detection.
Conclusion:
Threat hunters are essential in a SOC for uncovering sophisticated threats that automated systems
may miss. Their proactive approach is key to enhancing the organization's security posture.
Reference:
SANS Institute, "Threat Hunting: Open Season on the Adversary"
MITRE ATT&CK Framework
CISA Threat Hunting Guide
NIST Special Publication 800-61, "Computer Security Incident Handling Guide"
By searching for hidden threats that elude detection, threat hunters play a crucial role in maintaining
the security and integrity of an organization's network.

QUESTION 4
According to the National Institute of Standards and Technology (NIST) cybersecurity framework,
incident handling activities can be divided into phases.
In which incident handling phase do you quarantine a compromised host in order to prevent an
adversary from using it as a stepping stone to the next phase of an attack?

A. Containment
B. Analysis
C. Eradication
D. Recovery

Answer: A

Explanation:
NIST Cybersecurity Framework Overview:
The NIST Cybersecurity Framework provides a structured approach for managing and mitigating
cybersecurity risks. Incident handling is divided into several phases to systematically address and
resolve incidents.
Incident Handling Phases:
Preparation: Establishing and maintaining an incident response capability.
Detection and Analysis: Identifying and investigating suspicious activities to confirm an incident.
Containment, Eradication, and Recovery:
Containment: Limiting the impact of the incident.
Eradication: Removing the root cause of the incident.
Recovery: Restoring systems to normal operation.
Containment Phase:
The primary goal of the containment phase is to prevent the incident from spreading and causing
further damage.
Quarantining a Compromised Host:
Quarantining involves isolating the compromised host from the rest of the network to prevent
adversaries from moving laterally and causing more harm.
Techniques include network segmentation, disabling network interfaces, and applying access controls.
Reference: NIST Special Publication 800-61, "Computer Security Incident Handling Guide" NIST
Incident Handling
Detailed Process:
Step 1: Detect the compromised host through monitoring and analysis.
Step 2: Assess the impact and scope of the compromise.
Step 3: Quarantine the compromised host to prevent further spread. This can involve disconnecting
the host from the network or applying strict network segmentation.
Step 4: Document the containment actions and proceed to the eradication phase to remove the
threat completely.
Step 5: After eradication, initiate the recovery phase to restore normal operations and ensure that
the host is securely reintegrated into the network.
Importance of Containment:
Containment is critical in mitigating the immediate impact of an incident and preventing further
damage. It buys time for responders to investigate and remediate the threat effectively.
Reference: SANS Institute, "Incident Handler's Handbook" SANS Incident Handling
Reference:
NIST Special Publication 800-61, "Computer Security Incident Handling Guide"
SANS Institute, "Incident Handler's Handbook"
By quarantining a compromised host during the containment phase, organizations can effectively
limit the spread of the incident and protect their network from further compromise.

QUESTION 5
Which FortiAnalyzer connector can you use to run automation stitches9

A. FortiCASB
B. FortiMail
C. Local
D. FortiOS

Answer: D

Explanation:
Overview of Automation Stitches:
Automation stitches in FortiAnalyzer are predefined sets of automated actions triggered by specific
events. These actions help in automating responses to security incidents, improving efficiency, and
reducing the response time.
FortiAnalyzer Connectors:
FortiAnalyzer integrates with various Fortinet products and other third-party solutions through