Threat Detection & Incident Response Flashcards

A FortiSIEM correlation rule fires when five failed SSH logins occur within 60 seconds from the same source IP. Which attack stage does this rule primarily detect?

Answer: Credential brute-forcing

Repeated failed SSH authentication attempts from one source in a short window is a classic indicator of a brute-force credential attack.

Which FortiAnalyzer feature allows a SOC analyst to replay the sequence of events leading up to a confirmed incident for root-cause investigation?

Answer: Incident Timeline

FortiAnalyzer's Incident Timeline reconstructs the chronological sequence of log events associated with an incident to support root-cause analysis.

During a phishing investigation, an analyst discovers a malicious URL was clicked by three users. What is the FIRST containment action recommended using FortiGate?

Answer: Block the malicious URL using a Web Filter profile override

Immediately blocking the malicious URL via a FortiGate Web Filter override stops ongoing access without disrupting broader network operations.

FortiEDR detects an in-memory execution technique where shellcode is injected into a legitimate process. Which detection category best describes this behavior?

Answer: Process hollowing / code injection

Injecting shellcode into a legitimate running process is classified as code injection or process hollowing under endpoint threat detection.

An analyst is triaging a FortiSIEM incident with severity 'High'. The event count is 1 but the asset criticality is 'Critical'. What does this combination indicate?

Answer: A single event on a high-value asset warrants immediate investigation despite low volume

Asset criticality amplifies incident priority—even a single anomalous event on a critical asset demands prompt investigation.

Which FortiGate log type would an analyst consult to determine whether a specific host initiated an outbound connection to a known C2 IP address?

Answer: Traffic log (Forward Traffic)

Forward Traffic logs record all firewall policy-permitted or denied sessions including source/destination IPs and ports for outbound connections.

A playbook in FortiSOAR is configured to automatically enrich an IP indicator using threat intelligence. Which built-in action type performs this enrichment?

Answer: Connector action (e.g., VirusTotal IP Reputation lookup)

FortiSOAR connector actions integrate with threat intelligence sources like VirusTotal to automatically retrieve reputation data for IP indicators.