FCP Threat Detection & Incident Response 2 — Questions and Answers
Question 1: A FortiSIEM correlation rule fires when five failed SSH logins occur within 60 seconds from the same source IP. Which attack stage does this rule primarily detect?
- Credential brute-forcing (Correct answer)
- Lateral movement via pass-the-hash
- Data exfiltration over SSH
- Command-and-control beacon check-in
Correct answer: Credential brute-forcing
Repeated failed SSH authentication attempts from one source in a short window is a classic indicator of a brute-force credential attack.
Question 2: Which FortiAnalyzer feature allows a SOC analyst to replay the sequence of events leading up to a confirmed incident for root-cause investigation?
- Incident Timeline (Correct answer)
- Log Forwarding Profile
- ADOM Partition
- FortiView Top Threats
Correct answer: Incident Timeline
FortiAnalyzer's Incident Timeline reconstructs the chronological sequence of log events associated with an incident to support root-cause analysis.
Question 3: During a phishing investigation, an analyst discovers a malicious URL was clicked by three users. What is the FIRST containment action recommended using FortiGate?
- Block the malicious URL using a Web Filter profile override (Correct answer)
- Reset passwords for all domain users
- Shut down the core network switch
- Quarantine the FortiAnalyzer appliance
Correct answer: Block the malicious URL using a Web Filter profile override
Immediately blocking the malicious URL via a FortiGate Web Filter override stops ongoing access without disrupting broader network operations.
Question 4: FortiEDR detects an in-memory execution technique where shellcode is injected into a legitimate process. Which detection category best describes this behavior?
- Process hollowing / code injection (Correct answer)
- Persistence via registry run key
- DNS tunneling exfiltration
- SQL injection on an endpoint
Correct answer: Process hollowing / code injection
Injecting shellcode into a legitimate running process is classified as code injection or process hollowing under endpoint threat detection.
Question 5: An analyst is triaging a FortiSIEM incident with severity 'High'. The event count is 1 but the asset criticality is 'Critical'. What does this combination indicate?
- A single event on a high-value asset warrants immediate investigation despite low volume (Correct answer)
- The incident should be downgraded because only one event occurred
- The incident is a false positive due to low event count
- The asset criticality overrides severity, making it 'Low' priority
Correct answer: A single event on a high-value asset warrants immediate investigation despite low volume
Asset criticality amplifies incident priority—even a single anomalous event on a critical asset demands prompt investigation.
Question 6: Which FortiGate log type would an analyst consult to determine whether a specific host initiated an outbound connection to a known C2 IP address?
- Traffic log (Forward Traffic) (Correct answer)
- System event log
- VPN tunnel log
- HA heartbeat log
Correct answer: Traffic log (Forward Traffic)
Forward Traffic logs record all firewall policy-permitted or denied sessions including source/destination IPs and ports for outbound connections.
Question 7: A playbook in FortiSOAR is configured to automatically enrich an IP indicator using threat intelligence. Which built-in action type performs this enrichment?
- Connector action (e.g., VirusTotal IP Reputation lookup) (Correct answer)
- Manual task assigned to tier-1 analyst
- SNMP trap receiver
- Syslog forwarder to FortiAnalyzer
Correct answer: Connector action (e.g., VirusTotal IP Reputation lookup)
FortiSOAR connector actions integrate with threat intelligence sources like VirusTotal to automatically retrieve reputation data for IP indicators.
FCP Threat Detection & Incident Response 2
A FortiSIEM correlation rule fires when five failed SSH logins occur within 60 seconds from the same source IP.
Which attack stage does this rule primarily detect?