FCP Threat Detection & Incident Response 2

Question 1

A FortiSIEM correlation rule fires when five failed SSH logins occur within 60 seconds from the same source IP. Which attack stage does this rule primarily detect?

Accepted Answer

Credential brute-forcing

Answer

Repeated failed SSH authentication attempts from one source in a short window is a classic indicator of a brute-force credential attack.

Question 2

Which FortiAnalyzer feature allows a SOC analyst to replay the sequence of events leading up to a confirmed incident for root-cause investigation?

Accepted Answer

Incident Timeline

Answer

FortiAnalyzer's Incident Timeline reconstructs the chronological sequence of log events associated with an incident to support root-cause analysis.

Question 3

During a phishing investigation, an analyst discovers a malicious URL was clicked by three users. What is the FIRST containment action recommended using FortiGate?

Accepted Answer

Block the malicious URL using a Web Filter profile override

Answer

Immediately blocking the malicious URL via a FortiGate Web Filter override stops ongoing access without disrupting broader network operations.

Question 4

FortiEDR detects an in-memory execution technique where shellcode is injected into a legitimate process. Which detection category best describes this behavior?

Accepted Answer

Process hollowing / code injection

Answer

Injecting shellcode into a legitimate running process is classified as code injection or process hollowing under endpoint threat detection.

Question 5

An analyst is triaging a FortiSIEM incident with severity 'High'. The event count is 1 but the asset criticality is 'Critical'. What does this combination indicate?

Accepted Answer

A single event on a high-value asset warrants immediate investigation despite low volume

Answer

Asset criticality amplifies incident priority—even a single anomalous event on a critical asset demands prompt investigation.

(FCP) Fortinet Certified Professional Security Operations Practice Test

(FCP) Fortinet Certified Professional Security Operations Practice Test

FCP Threat Detection & Incident Response 2