FCP Threat Detection & Incident Response 3

Question 1

Which MITRE ATT&CK tactic does FortiDeceptor primarily address by luring attackers into interacting with honeypot assets?

Accepted Answer

Discovery

Answer

FortiDeceptor honeypots attract attackers performing internal discovery scans, triggering alerts when decoy assets are probed.

Question 2

An analyst needs to search across 90 days of compressed archive logs in FortiAnalyzer. Which feature enables queries against these historical records?

Accepted Answer

Log Fetch (Archive Log Search)

Answer

FortiAnalyzer's Log Fetch feature retrieves and indexes archived logs from storage, enabling historical queries beyond the hot-log window.

Question 3

During incident eradication, an analyst removes malware from an infected host. What is the NEXT step in the NIST incident response lifecycle after eradication?

Accepted Answer

Recovery

Answer

After eradication, the NIST lifecycle moves to Recovery—restoring systems to normal operations and monitoring for signs of reinfection.

Question 4

FortiGate's Intrusion Prevention System (IPS) generates an alert for CVE-2021-44228 (Log4Shell). Which action should a SOC analyst take FIRST?

Accepted Answer

Verify whether the target host is running a vulnerable Log4j version

Answer

Confirming whether the targeted asset actually runs a vulnerable Log4j version determines if the alert is a true positive before taking disruptive action.

Question 5

What is the purpose of a FortiSIEM 'Watch List' in the context of threat detection?

Accepted Answer

A dynamic list of high-risk entities (users, IPs, hosts) that triggers enhanced monitoring rules

Answer

Watch Lists in FortiSIEM allow analysts to flag specific entities for elevated scrutiny, enabling correlation rules to fire with lower thresholds for those entities.

(FCP) Fortinet Certified Professional Security Operations Practice Test

(FCP) Fortinet Certified Professional Security Operations Practice Test

FCP Threat Detection & Incident Response 3