Threat Detection & Incident Response Flashcards

Which MITRE ATT&CK tactic does FortiDeceptor primarily address by luring attackers into interacting with honeypot assets?

Answer: Discovery

FortiDeceptor honeypots attract attackers performing internal discovery scans, triggering alerts when decoy assets are probed.

An analyst needs to search across 90 days of compressed archive logs in FortiAnalyzer. Which feature enables queries against these historical records?

Answer: Log Fetch (Archive Log Search)

FortiAnalyzer's Log Fetch feature retrieves and indexes archived logs from storage, enabling historical queries beyond the hot-log window.

During incident eradication, an analyst removes malware from an infected host. What is the NEXT step in the NIST incident response lifecycle after eradication?

Answer: Recovery

After eradication, the NIST lifecycle moves to Recovery—restoring systems to normal operations and monitoring for signs of reinfection.

FortiGate's Intrusion Prevention System (IPS) generates an alert for CVE-2021-44228 (Log4Shell). Which action should a SOC analyst take FIRST?

Answer: Verify whether the target host is running a vulnerable Log4j version

Confirming whether the targeted asset actually runs a vulnerable Log4j version determines if the alert is a true positive before taking disruptive action.

What is the purpose of a FortiSIEM 'Watch List' in the context of threat detection?

Answer: A dynamic list of high-risk entities (users, IPs, hosts) that triggers enhanced monitoring rules

Watch Lists in FortiSIEM allow analysts to flag specific entities for elevated scrutiny, enabling correlation rules to fire with lower thresholds for those entities.

Which FortiEDR response capability allows an analyst to isolate a compromised endpoint from the network while maintaining the FortiEDR management channel?

Answer: Network Isolation (Forensic Mode)

FortiEDR's Network Isolation (Forensic Mode) blocks all network traffic except the management tunnel, allowing continued investigation without network spread.

In a FortiSOAR incident response workflow, what does the 'Escalate' action typically trigger?

Answer: A notification to a higher-tier analyst and an increase in incident severity

The Escalate action in FortiSOAR notifies senior analysts and typically raises the incident's severity or SLA priority for faster response.