Threat Detection & Incident Response Flashcards

Which FortiGate feature can automatically quarantine an endpoint detected by FortiEDR as compromised, without manual SOC intervention?

Answer: Fabric Agent integration with Endpoint Quarantine via Security Fabric

The Fortinet Security Fabric enables FortiEDR to trigger automated endpoint quarantine on FortiGate via the Fabric Agent, removing the host from the network instantly.

An analyst reviews FortiSIEM and sees an incident tagged 'False Positive' but the same attack pattern recurs the next day. What is the BEST corrective action?

Answer: Tune the correlation rule to reduce false positives while preserving true positive detection

Rule tuning adjusts thresholds or adds exception conditions to reduce noise without losing the ability to detect genuine attacks with the same pattern.

In FortiSOAR, what is the role of a 'Playbook Trigger' based on an incoming alert from FortiSIEM?

Answer: It automatically initiates a predefined response workflow when FortiSIEM pushes a matching alert

A FortiSOAR playbook trigger listens for inbound alerts from integrated sources like FortiSIEM and automatically launches the mapped response playbook.

During a post-incident review, the team finds that an attacker used DNS-over-HTTPS (DoH) to evade detection. Which Fortinet control should be implemented to address this gap?

Answer: Enable DNS Filter to block DoH providers and force DNS traffic through FortiGate's resolver

FortiGate's DNS Filter can block known DoH provider domains and IPs, forcing clients to use inspectable DNS and preventing covert channel abuse.

Which phase of the Cyber Kill Chain does FortiSandbox MOST directly address by detonating suspicious files in an isolated environment?

Answer: Delivery and Exploitation

FortiSandbox detects malicious payloads during the Delivery and Exploitation phases by safely executing files and observing their behavior before they reach endpoints.

A threat hunter finds evidence of T1003 (OS Credential Dumping) on a Windows host via FortiEDR telemetry. Which attacker tool is MOST commonly associated with this technique?

Answer: Mimikatz

Mimikatz is the most widely associated tool with LSASS memory dumping and other Windows credential extraction techniques mapped to MITRE T1003.

FortiAnalyzer shows a spike in 'Application Control' block events for the 'Tor' application category from multiple internal hosts. What is the MOST appropriate initial incident response action?

Answer: Identify the internal hosts involved and investigate whether Tor usage is policy-sanctioned or indicative of data exfiltration

The first step is identifying the affected hosts and determining whether Tor use violates policy or indicates exfiltration before taking broader disruptive actions.