FCP Threat Detection & Incident Response 4

Question 1

A FortiGate IPS log shows action='dropped' for a signature matching a known ransomware callback. What does this confirm from a detection perspective?

Accepted Answer

The malicious traffic was blocked inline, but the endpoint may still be compromised

Answer

'Dropped' confirms inline blocking of the C2 callback, but it does not confirm that the endpoint itself has been cleaned or that encryption has not already begun.

Question 2

Which FortiAnalyzer report template is most useful for providing executive leadership with a weekly summary of security posture and top threats?

Accepted Answer

Executive Summary Report

Answer

The Executive Summary Report in FortiAnalyzer presents high-level KPIs, top threats, and trend data in a format suitable for non-technical leadership.

Question 3

An analyst observes beaconing traffic from an internal host to an external IP at regular 5-minute intervals. Which FortiSIEM rule type is best suited to detect this pattern?

Accepted Answer

Frequency-based correlation rule with a fixed time window

Answer

Frequency-based correlation rules count events over a sliding or fixed time window, making them ideal for detecting periodic beaconing patterns.

Question 4

During forensic analysis, an analyst needs to preserve the integrity of collected evidence. Which practice ensures admissibility and chain of custody?

Accepted Answer

Hashing evidence files (MD5/SHA-256) immediately upon collection and logging each access

Answer

Cryptographic hashing at collection time and maintaining an access log establishes integrity and an unbroken chain of custody for digital evidence.

Question 5

FortiMail detects an email with a spoofed sender domain that passes SPF but fails DMARC alignment. What does this indicate?

Accepted Answer

The email's From: header domain differs from the SPF-authorized domain (header mismatch)

Answer

DMARC alignment failure despite SPF pass means the RFC5321 MailFrom domain is authorized but doesn't align with the RFC5322 From: header, a common spoofing technique.

(FCP) Fortinet Certified Professional Security Operations Practice Test

(FCP) Fortinet Certified Professional Security Operations Practice Test

FCP Threat Detection & Incident Response 4