FCP Threat Detection & Incident Response 5

Question 1

Which FortiGate feature can automatically quarantine an endpoint detected by FortiEDR as compromised, without manual SOC intervention?

Accepted Answer

Fabric Agent integration with Endpoint Quarantine via Security Fabric

Answer

The Fortinet Security Fabric enables FortiEDR to trigger automated endpoint quarantine on FortiGate via the Fabric Agent, removing the host from the network instantly.

Question 2

An analyst reviews FortiSIEM and sees an incident tagged 'False Positive' but the same attack pattern recurs the next day. What is the BEST corrective action?

Accepted Answer

Tune the correlation rule to reduce false positives while preserving true positive detection

Answer

Rule tuning adjusts thresholds or adds exception conditions to reduce noise without losing the ability to detect genuine attacks with the same pattern.

Question 3

In FortiSOAR, what is the role of a 'Playbook Trigger' based on an incoming alert from FortiSIEM?

Accepted Answer

It automatically initiates a predefined response workflow when FortiSIEM pushes a matching alert

Answer

A FortiSOAR playbook trigger listens for inbound alerts from integrated sources like FortiSIEM and automatically launches the mapped response playbook.

Question 4

During a post-incident review, the team finds that an attacker used DNS-over-HTTPS (DoH) to evade detection. Which Fortinet control should be implemented to address this gap?

Accepted Answer

Enable DNS Filter to block DoH providers and force DNS traffic through FortiGate's resolver

Answer

FortiGate's DNS Filter can block known DoH provider domains and IPs, forcing clients to use inspectable DNS and preventing covert channel abuse.

Question 5

Which phase of the Cyber Kill Chain does FortiSandbox MOST directly address by detonating suspicious files in an isolated environment?

Accepted Answer

Delivery and Exploitation

Answer

FortiSandbox detects malicious payloads during the Delivery and Exploitation phases by safely executing files and observing their behavior before they reach endpoints.

(FCP) Fortinet Certified Professional Security Operations Practice Test

(FCP) Fortinet Certified Professional Security Operations Practice Test

FCP Threat Detection & Incident Response 5