Threat Detection & Incident Response Flashcards

A FortiGate IPS log shows action='dropped' for a signature matching a known ransomware callback. What does this confirm from a detection perspective?

Answer: The malicious traffic was blocked inline, but the endpoint may still be compromised

'Dropped' confirms inline blocking of the C2 callback, but it does not confirm that the endpoint itself has been cleaned or that encryption has not already begun.

Which FortiAnalyzer report template is most useful for providing executive leadership with a weekly summary of security posture and top threats?

Answer: Executive Summary Report

The Executive Summary Report in FortiAnalyzer presents high-level KPIs, top threats, and trend data in a format suitable for non-technical leadership.

An analyst observes beaconing traffic from an internal host to an external IP at regular 5-minute intervals. Which FortiSIEM rule type is best suited to detect this pattern?

Answer: Frequency-based correlation rule with a fixed time window

Frequency-based correlation rules count events over a sliding or fixed time window, making them ideal for detecting periodic beaconing patterns.

During forensic analysis, an analyst needs to preserve the integrity of collected evidence. Which practice ensures admissibility and chain of custody?

Answer: Hashing evidence files (MD5/SHA-256) immediately upon collection and logging each access

Cryptographic hashing at collection time and maintaining an access log establishes integrity and an unbroken chain of custody for digital evidence.

FortiMail detects an email with a spoofed sender domain that passes SPF but fails DMARC alignment. What does this indicate?

Answer: The email's From: header domain differs from the SPF-authorized domain (header mismatch)

DMARC alignment failure despite SPF pass means the RFC5321 MailFrom domain is authorized but doesn't align with the RFC5322 From: header, a common spoofing technique.

When FortiNDR identifies anomalous east-west traffic between two internal servers that never previously communicated, which threat scenario is MOST likely?

Answer: Lateral movement by an attacker who has already compromised one server

Unexpected peer-to-peer communication between internal servers that have no history of contact is a strong indicator of attacker lateral movement.

A SOC team wants to measure how quickly they detect intrusions after attacker entry. Which metric does this represent?

Answer: Mean Time to Detect (MTTD)

MTTD measures the average time elapsed between an attacker gaining access and the SOC detecting the intrusion.