NSE7_SOC_AR-7.6 무료 덤프문제 온라인 액세스

Which two statements accurately describe the Custom API Endpoint playbook trigger? Choose two answers.

• A.It supports HTTP POST, GET, and PUT methods.
• B.It supports token-based, basic, and no authentication.
• C.One custom API endpoint can trigger multiple playbooks at the same time.
• D.An external system can initiate a playbook using an arbitrary endpoint on FortiSOAR.

Refer to the exhibit. What is the correct Jinja expression to filter the results to show only the MD5 hash values?
{{ [slot 1] | [slot 2] [slot 3].[slot 4] }}
Select the Jinja expression in the left column, hold and drag it to a blank position on the right. Place the four correct steps in order, placing the first step in the first slot.

정답:

Explanation:
Slot 1: data Slot 2: json_query Slot 3: ( " results[?type== ' FileHash-MD5 ' ] " ) Slot 4: value Final Expression: {{ vars.artifacts.data | json_query( " results[?type== ' FileHash-MD5 ' ] " ) .value }} In FortiSOAR 7.6 , advanced data manipulation within playbooks often requires the use of JMESPath queries via the json_query Jinja filter. To extract specific data from a complex JSON object (like the vars.
artifacts dictionary shown in the exhibit), the analyst must follow the structural hierarchy:
* Slot 1 (data): Based on the exhibit, the root of the artifact information is located under vars.artifacts.
data. Therefore, " data " is the starting point for the filter.
* Slot 2 (json_query): To perform advanced filtering (searching for a specific type), the json_query filter must be applied. This allows the playbook to traverse the list and find items matching a specific key- value pair.
* Slot 3 ( " results[?type== ' FileHash-MD5 ' ] " ): This is the JMESPath expression. It looks into the results array and applies a filter [?...] to find only those objects where the type attribute exactly matches FileHash-MD5.
* Slot 4 (value): Once the correct object(s) are found, the expression needs to return the actual hash. In the JSON exhibit, the MD5 string is stored in the key named value.
Why other options are incorrect:
* tojson: This filter converts a dictionary/list into a JSON string, which would break the ability to further query the object for the " value " field.
* results (as a standalone slot): While " results " is part of the path, it is handled inside the json_query string to allow for conditional filtering.

While monitoring your network, you discover that one FortiGate device is sending significantly more logs to FortiAnalyzer than all of the other FortiGate devices in the topology.
Additionally, the ADOM that the FortiGate devices are registered to consistently exceeds its quota.
What are two possible solutions? (Choose two.)

• A.Create a separate ADOM for the first FortiGate device and configure a different set of storage policies.
• B.Increase the storage space quota for the first FortiGate device.
• C.Configure data selectors to filter the data sent by the first FortiGate device.
• D.Reconfigure the first FortiGate device to reduce the number of logs it forwards to FortiAnalyzer.

Refer to the exhibit.

You must configure the FortiGate connector to allow FortiSOAR to perform actions on a firewall. However, the connection fails. Which two configurations are required? (Choose two answers)

• A.HTTPS must be enabled on the FortiGate interface that FortiSOAR will communicate with.
• B.An API administrator must be created on FortiGate with the appropriate profile, along with a generated API key to configure on the connector.
• C.Trusted hosts must be enabled and the FortiSOAR IP address must be permitted.
• D.The VDOM name must be specified, or set to VDOM_1, if VDOMs are not enabled on FortiGate.

Refer to the exhibits.
The DOS attack playbook is configured to create an incident when an event handler generates a denial-of-ser
/ice (DoS) attack event.
Why did the DOS attack playbook fail to execute?

• A.The Create SMTP Enumeration incident task is expecting an integer value but is receiving the incorrect data type
• B.The Attach_Data_To_lncident task failed.
• C.The Get Events task is configured to execute in the incorrect order.
• D.The Attach_Data_To_lncident task is expecting an integer value but is receiving the incorrect data type.