Free Fortinet NSE 7 - Security Operations Architect Questions & Answers 2026 Part2

Question #1

Refer to the exhibit.You are investigating an open incident and want to add records from the Tickets module, a custom module, to the visual correlation widget. Assume there are already linked ticket records to the incident.How do you accomplish this?

A. Edit the incident template and add the Tickets module to the graph

B. Define move module relationships under Correlation Settings

C. Tag ticket records with the incident ID

D. Ingest ticket records through a custom connector

View answer

Correct Answer: A

Question #2

Refer to the exhibit.You are reviewing the Triggering Events page for a FortiSIEM incident. You want to remove the Reporting IP column because you have only one firewall in the topology.How do you accomplish this?

A. Customize the display columns for this incident

B. Remove the Reporting IP attribute from the raw logs using parsing rules

C. Disable correlation for the Reporting IP field in the rule subpattern

D. Clear the Reporting IP field from the Triggered Attributes section when you configure the Incident Action

View answer

Correct Answer: A

Question #3

Refer to the exhibits.Assume that the traffic flows are identical, except for the destination IP address. There is only one FortiGate in network address translation (NAT) mode in this environment.Based on the exhibits, which two conclusions can you make about this FortiSIEM incident? (Choose two answers)

A. The client 10

B. FortiGate is not routing the packets to the destination hosts

C. The destination hosts are not responding

D. FortiGate is blocking the return flows

View answer

Correct Answer: AC

Question #4

Review the incident report:An attacker identified employee names, roles, and email patterns from public press releases, which were then used to craft tailored emails.The emails were directed to recipients to review an attached agenda using a link hosted off the corporate domain.Which two MITRE ATT&CK tactics best fit this report? (Choose two answers)

A. Reconnaissance

B. Discovery

C. Initial Access

D. Defense Evasion

View answer

Correct Answer: AC

Question #5

Refer to the exhibit.How do you add a piece of evidence to the Action Logs Marked As Evidence area? (Choose one answer)

A. By tagging output or a workspace comment with the keyword Evidence

B. By linking an indicator to the war room

C. By creating an evidence collection task and attaching a file

D. By executing a playbook with the Save Execution Logs option enabled

View answer

Correct Answer: A

Question #6

Refer to the exhibit.How do you add a piece of evidence to the Action Logs Marked As Evidence area? (Choose one answer)

A. By tagging output or a workspace comment with the keyword Evidence

B. By linking an indicator to the war room

C. By creating an evidence collection task and attaching a file

D. By executing a playbook with the Save Execution Logs option enabled

View answer

Correct Answer: A

Question #7

Review the incident report:An attacker identified employee names, roles, and email patterns from public press releases, which were then used to craft tailored emails.The emails were directed to recipients to review an attached agenda using a link hosted off the corporate domain.Which two MITRE ATT&CK tactics best fit this report? (Choose two answers)

A. Reconnaissance

B. Discovery

C. Initial Access

D. Defense Evasion

View answer

Correct Answer: AC

Question #8

Based on the Pyramid of Pain model, which two statements accurately describe the value of an indicator and how it is for an adversary to change? (Choose two.)

A. Tactics, techniques, and procedures are hard because adversaries must adapt their methods

B. Tools are easy because often, multiple alternatives exist

C. IP addresses are easy because adversaries can spoof them or move them to new resources

D. Artifacts are easy because adversaries can alter file paths or registry keys

View answer

Correct Answer: AC

Question #9

When you use a manual trigger to save user input as a variable, what is the correct Jinja expression to reference the variable? (Choose one answer)

A. {{ vars

B. {{ globalVars

C. {{ vars

D. {{ vars

View answer

Correct Answer: A

Question #10

When you use a manual trigger to save user input as a variable, what is the correct Jinja expression to reference the variable? (Choose one answer)

A. {{ vars

B. {{ globalVars

C. {{ vars

D. {{ vars

View answer

Correct Answer: A

Question #11

A partner organization recently suffered a distributed denial-of-service (DDoS) attack, but the adversary's identity and TTPs remain unknown. Your SOC has not received any relevant threat intelligence from the partner organization, but you are asked to determine whether similar activity could be happening in your environment. Which threat hunting action should you perform first? Choose one answer.

A. onfigure SIEM rules to alert when inbound traffic exceeds baseline thresholds

B. se threat intelligence to enrich the IP addresses of all external source IP addresses

C. se a packet analyzer to capture and review all traffic flows on critical devices

D. evelop a hunting hypothesis based on how DDoS can be executed against your network

View answer

Correct Answer: D

Question #12

Refer to the exhibit.You configured a playbook named False Positive Close, and want to run it to verify if it works. However, when you click Execute and search for the playbook, you do not see it listed.Which two reasons could be the cause of the problem? (Choose two.)

A. The manual trigger is configured to require record input to run

B. The playbook must first be published using the Application Editor

C. The Alerts module is not among the list of modules the playbook can execute on

D. Another instance of the playbook is currently executing

View answer

Correct Answer: AC

Question #13

Refer to the exhibits.Assume that the traffic flows are identical, except for the destination IP address. There is only one FortiGate in network address translation (NAT) mode in this environment.Based on the exhibits, which two conclusions can you make about this FortiSIEM incident? (Choose two answers)

A. The client 10

B. FortiGate is not routing the packets to the destination hosts

C. The destination hosts are not responding

D. FortiGate is blocking the return flows

View answer

Correct Answer: AC

Question #14

Which three are threat hunting activities? (Choose three answers)

A. Enrich records with threat intelligence

B. Automate workflows

C. Generate a hypothesis

D. Perform packet analysis

E. Tune correlation rules

View answer

Correct Answer: ACD

Question #15

Review the incident report:An attacker identified employee names, roles, and email patterns from public press releases, which were then used to craft tailored emails.The emails were directed to recipients to review an attached agenda using a link hosted off the corporate domain.Which two MITRE ATT&CK tactics best fit this report? (Choose two answers)

A. Reconnaissance

B. Discovery

C. Initial Access

D. Defense Evasion

View answer

Correct Answer: AC

Question #16

Refer to the exhibits.The DOS attack playbook is configured to create an incident when an event handler generates a denial-of-ser/ice (DoS) attack event.Why did the DOS attack playbook fail to execute?

A. he Attach_Data_To_lncident task failed

B. he Attach_Data_To_lncident task is expecting an integer value but is receiving the incorrect data type

C. he Create SMTP Enumeration incident task is expecting an integer value but is receiving the incorrect data type

D. he Get Events task is configured to execute in the incorrect order

View answer

Correct Answer: C

Question #17

Review the incident report:An attacker identified employee names, roles, and email patterns from public press releases, which were then used to craft tailored emails.The emails were directed to recipients to review an attached agenda using a link hosted off the corporate domain.Which two MITRE ATT&CK tactics best fit this report? (Choose two answers)

A. Reconnaissance

B. Discovery

C. Initial Access

D. Defense Evasion

View answer

Correct Answer: AC

Question #18

Which two ways can you create an incident on FortiAnalyzer? (Choose two answers)

A. Using a custom event handler

B. Using a connector action

C. Manually, on the Event Monitor page

D. By running a playbook

View answer

Correct Answer: AD

Question #19

Refer to the exhibit.How do you add a piece of evidence to the Action Logs Marked As Evidence area? (Choose one answer)

A. By tagging output or a workspace comment with the keyword Evidence

B. By linking an indicator to the war room

C. By creating an evidence collection task and attaching a file

D. By executing a playbook with the Save Execution Logs option enabled

View answer

Correct Answer: A

Question #20

Refer to the exhibit.How do you add a piece of evidence to the Action Logs Marked As Evidence area? (Choose one answer)

A. By tagging output or a workspace comment with the keyword Evidence

B. By linking an indicator to the war room

C. By creating an evidence collection task and attaching a file

D. By executing a playbook with the Save Execution Logs option enabled

View answer

Correct Answer: A

Question #21

When you use a manual trigger to save user input as a variable, what is the correct Jinja expression to reference the variable? (Choose one answer)

A. {{ vars

B. {{ globalVars

C. {{ vars

D. {{ vars

View answer

Correct Answer: A

Question #22

Refer to the exhibits.Assume that the traffic flows are identical, except for the destination IP address. There is only one FortiGate in network address translation (NAT) mode in this environment.Based on the exhibits, which two conclusions can you make about this FortiSIEM incident? (Choose two answers)

A. The client 10

B. FortiGate is not routing the packets to the destination hosts

C. The destination hosts are not responding

D. FortiGate is blocking the return flows

View answer

Correct Answer: AC

Question #23

Which three are threat hunting activities? (Choose three.)

A. Generate a hypothesis

B. Tune correlation rules

C. Perform packet analysis

D. Automate workflows

E. Enrich records with threat intelligence

View answer

Correct Answer: ACE

DON'T WANT TO MISS A THING?

Latest Cisco, PMP, AWS, CompTIA, Microsoft Materials on SALE
Get Now

Free Fortinet NSE 7 - Security Operations Architect Questions & Answers 2026 Part2

View The Updated Fortinet Exam Questions

View Answers after Submission

DON'T WANT TO MISS A THING?

Latest Cisco, PMP, AWS, CompTIA, Microsoft Materials on SALE Get Now

Free Fortinet NSE 7 - Security Operations Architect Questions & Answers 2026 Part2

View The Updated Fortinet Exam Questions

View Answers after Submission

Latest Cisco, PMP, AWS, CompTIA, Microsoft Materials on SALE
Get Now