Fortinet Updated NSE7_SOC_AR-7.6 Exam Questions and Answers by arla

Exact Extract: “Fortinet recommends that you test a search query first in FortiSIEM to ensure that there are matching event logs. Then you can implement the same logic and time range with the connector action.”

Exact Extract: “You can define a time range, such as the last 30 days, and the maximum number of records to return in your query.”

The correct answer is A . The exhibit shows the FortiSIEM connector action completed with status: Success , but the returned events array is empty and totalCount is 0 . That means the connector did not fail; the query simply did not return matching FortiSIEM event logs. The first troubleshooting step is to run the same search directly in FortiSIEM Analytics with the same filters and time range to confirm whether matching logs actually exist.

B is wrong because saving empty output into a variable does not solve the missing results. C is not first because the connector action already shows Success , so connectivity is not the immediate problem. D is useful when mapping fields or understanding schema, but the immediate evidence points to no matching data, not unknown output structure.

Technical Deep Dive: In FortiSOAR threat-hunting playbooks, connector success only proves the API call completed. It does not prove the search logic was correct. Check the FortiSIEM query directly for event type, attribute names, time range, organization scope, and maximum result count. In this case, events: [] and totalCount: 0 are the hard clues. This is FortiSOAR-to-FortiSIEM query troubleshooting; FortiGate NP/CP offloading is irrelevant because no firewall packet-processing path is involved.

In accordance with the MITRE ATT & CK mapping utilized by FortiSIEM 7.3 and FortiSOAR 7.6 , the described behaviors correspond to the following techniques:

Non-Standard Port (T1571): This technique involves adversaries communicating using a protocol and port pairing that are typically not associated. The incident report identifies HTTPS (TLS) traffic running on TCP 8443 rather than the standard port 443. FortiSIEM specifically includes built-in correlation rules, such as " Suspicious Typical Malware Back Connect Ports, " designed to detect these protocol-port mismatches.

Exfiltration Over Alternative Protocol (T1048): This technique describes adversaries stealing data by exfiltrating it over a different protocol than the primary command and control (C2) channel. In this scenario, while the C2 channel is established via HTTPS on port 8443, the adversary is transferring staged files using DNS queries with oversized TXT payloads . DNS is a common " alternative protocol " used to bypass standard data transfer monitoring and egress filtering.

Analysis of Incorrect Options:

Exploitation of Remote Services (B): This technique falls under Initial Access or Lateral Movement tactics, focusing on gaining entry into a system via vulnerabilities in network services like SMB or RDP. It does not apply to the maintenance of an established C2 channel or the exfiltration of data.

Hide Artifacts (D): This is a Defense Evasion technique where an adversary attempts to conceal their presence by removing traces such as log files or registry keys. While the attacker is " imitating normal traffic, " the specific acts of using a non-standard port and DNS exfiltration are primary behavioral signatures defined by their own more specific techniques.

Exact Extract: “Use the Wait step to specify the time that the playbook should wait after a specific step before continuing with the remaining steps in the playbook. Alternatively, specify the conditions that must be met before the playbook continues. For example, investigation playbooks should wait for enrichment to finish before continuing with the subsequent steps.”

The correct answers are A and B . A Wait step can resume after a defined duration, so option A is valid. It can also resume when a condition is met, such as the indicator record being updated after the reputation lookup or enrichment process completes, so option B is also valid. Option C is not a Wait-step function; retrying failed actions at intervals belongs to step execution/error-handling behavior, not the Wait step’s purpose. Option D is also wrong because executing another playbook is handled by a separate reference/playbook execution step, not by the Wait step while it is paused. The guide separately identifies “Reference a Playbook” as the step used to execute another playbook.

Technical Deep Dive: In FortiSOAR playbooks, Wait is a control-flow gate. Use time-based waiting when an external system has predictable processing latency, for example waiting 60 seconds after submitting an IOC to a sandbox or reputation service. Use condition-based waiting when the downstream update is asynchronous, for example waiting until an indicator’s reputation, enrichment status, or related field changes. This prevents the playbook from reading incomplete enrichment data. This is SOAR workflow orchestration; FortiGate NP/CP hardware offloading is irrelevant because no traffic forwarding, session acceleration, or content processor inspection is involved.

Exact Extract: “You must enable HTTPS on the FortiGate interface that the FortiGate connector on FortiSOAR is pointing to. If trusted hosts are enabled on the API administrator used by FortiSOAR, you must add the FortiSOAR IP address to the list.”

Exact Extract: “When assigning an administrator profile to the API user, you must assign the required permissions to perform the actions you want completed on the connector. Consult the connector documentation for more information.”

The correct answers are A and B . In the exhibit, the FortiGate interface Transit (port2) has no administrative access enabled. Because the FortiSOAR FortiGate connector communicates with FortiGate by API over HTTPS, HTTPS must be enabled on the FortiGate interface that FortiSOAR targets. Also, the REST API admin has Trusted Hosts enabled, but the trusted host shown is 10.0.0.100 , while the FortiSOAR IP is 10.200.200.160 . FortiGate will reject API access from FortiSOAR unless 10.200.200.160/32 is allowed as a trusted host. Option C can matter for specific actions, but it is not the shown connection failure. Option D is nonsense; FortiGate interface roles do not include “Custom API Endpoint.”

Technical Deep Dive: The FortiSOAR connector calls the FortiGate REST API over HTTPS, so FortiGate must accept HTTPS management traffic on the target interface and must allow the API user source IP. CLI equivalent:

config system interface

edit " port2 "

set allowaccess https

next

end

config system api-user

edit " API-User "

set accprofile " API_Profile "

config trusthost

edit 1

set ipv4-trusthost 10.200.200.160 255.255.255.255

next

end

next

end

NP/CP hardware offloading is irrelevant here. This is management-plane HTTPS/API access, not data-plane traffic acceleration.