FCP Threat Detection & Incident Response 4 — Questions and Answers
Question 1: A FortiGate IPS log shows action='dropped' for a signature matching a known ransomware callback. What does this confirm from a detection perspective?
- The malicious traffic was blocked inline, but the endpoint may still be compromised (Correct answer)
- The ransomware was fully eradicated from the network
- The IPS is running in monitoring-only mode
- The signature is outdated and should be updated
Correct answer: The malicious traffic was blocked inline, but the endpoint may still be compromised
'Dropped' confirms inline blocking of the C2 callback, but it does not confirm that the endpoint itself has been cleaned or that encryption has not already begun.
Question 2: Which FortiAnalyzer report template is most useful for providing executive leadership with a weekly summary of security posture and top threats?
- Executive Summary Report (Correct answer)
- Raw Syslog Export
- Interface Statistics Report
- VPN Usage Report
Correct answer: Executive Summary Report
The Executive Summary Report in FortiAnalyzer presents high-level KPIs, top threats, and trend data in a format suitable for non-technical leadership.
Question 3: An analyst observes beaconing traffic from an internal host to an external IP at regular 5-minute intervals. Which FortiSIEM rule type is best suited to detect this pattern?
- Frequency-based correlation rule with a fixed time window (Correct answer)
- Single-event threshold rule
- Asset discovery rule
- Compliance audit rule
Correct answer: Frequency-based correlation rule with a fixed time window
Frequency-based correlation rules count events over a sliding or fixed time window, making them ideal for detecting periodic beaconing patterns.
Question 4: During forensic analysis, an analyst needs to preserve the integrity of collected evidence. Which practice ensures admissibility and chain of custody?
- Hashing evidence files (MD5/SHA-256) immediately upon collection and logging each access (Correct answer)
- Storing evidence on a shared network drive for team access
- Deleting duplicate log entries before archiving
- Using the production system to analyze live malware samples
Correct answer: Hashing evidence files (MD5/SHA-256) immediately upon collection and logging each access
Cryptographic hashing at collection time and maintaining an access log establishes integrity and an unbroken chain of custody for digital evidence.
Question 5: FortiMail detects an email with a spoofed sender domain that passes SPF but fails DMARC alignment. What does this indicate?
- The email's From: header domain differs from the SPF-authorized domain (header mismatch) (Correct answer)
- The sending mail server is not in the SPF record at all
- DMARC is misconfigured on FortiMail and should be disabled
- The email is definitively safe because SPF passed
Correct answer: The email's From: header domain differs from the SPF-authorized domain (header mismatch)
DMARC alignment failure despite SPF pass means the RFC5321 MailFrom domain is authorized but doesn't align with the RFC5322 From: header, a common spoofing technique.
Question 6: When FortiNDR identifies anomalous east-west traffic between two internal servers that never previously communicated, which threat scenario is MOST likely?
- Lateral movement by an attacker who has already compromised one server (Correct answer)
- A new software update synchronizing between servers
- A misconfigured OSPF route advertisement
- Normal DNS resolution traffic
Correct answer: Lateral movement by an attacker who has already compromised one server
Unexpected peer-to-peer communication between internal servers that have no history of contact is a strong indicator of attacker lateral movement.
Question 7: A SOC team wants to measure how quickly they detect intrusions after attacker entry. Which metric does this represent?
- Mean Time to Detect (MTTD) (Correct answer)
- Mean Time to Respond (MTTR)
- Mean Time Between Failures (MTBF)
- Recovery Point Objective (RPO)
Correct answer: Mean Time to Detect (MTTD)
MTTD measures the average time elapsed between an attacker gaining access and the SOC detecting the intrusion.
FCP Threat Detection & Incident Response 4
A FortiGate IPS log shows action='dropped' for a signature matching a known ransomware callback.
What does this confirm from a detection perspective?