NSE7_SOC_AR-7.6最も有効な質問と解答で勉強

Refer to this partial incident output:
Condition: if this pattern occurs within any 1800-second time window.
Host Interface Name: Red Hat VirtIO Ethernet Adapter
Recv Packet Errors: 0
Sent Packet Errors: 0
Recv Packet Discards: 37
Sent Packet Discards: 0
Recv Packet Error Pct: 0.00
Sent Packet Error Pct: 0.00
Recv Packet Discard Pct: 7.17
Sent Packet Discard Pct: 0.00
Avg Recv Interface Error: 0.00
Avg Sent Interface Error: 0.00
Avg Recv Interface Discard: 16.45
Avg Sent Interface Discard: 0.00
Which conclusion can you make about this incident? Choose one answer.

• A. It was triggered from a FortiAI machine learning rule.
• B. It was triggered by a baseline profile incident rule.
• C. It was triggered by a correlation rule.
• D. It was triggered by a lookup table.

You want to use the queue and shift management feature to automatically assign newly created low-priority tasks to members of the L1 queue. However, you are unable to add the Tasks module to the Module Types list. What is the problem? Choose one answer.

• A. The Queueable option is disabled for the Tasks module.
• B. The Tasks module is not supported by queue and shift management.
• C. Shift-based assignment is disabled.
• D. There is a higher priority queue for the Tasks module.

Review the incident report. A fake HR login page was sent to several employees through email. The page copied the company's branding and captured usernames and passwords. The attacker later used the stolen credentials to sign in through the company's web VPN. Which two MITRE ATT & CK tactics best characterize this report? Choose two answers.

• A. Credential Access
• B. Defense Evasion
• C. Initial Access
• D. Command and Control

You configured a queue called L1 Analysts and generated shifts to cover morning, evening, and overnight shifts, with two members covering each shift.
However, you noticed that all members of the queue are assigned ingested alerts in a round-robin fashion, instead of only users who are currently on shift.
What is the problem?

• A. Shift-based assignment is disabled.
• B. The Queueable option is disabled for the Alerts module.
• C. The queue rules conflict with the user assignment rules.
• D. The shift lead needs to disable automatic shift handover.

According to the National Institute of Standards and Technology (NIST) cybersecurity framework, incident handling activities can be divided into phases.
In which incident handling phase do you quarantine a compromised host in order to prevent an adversary from using it as a stepping stone to the next phase of an attack?

• A. Recovery
• B. Analysis
• C. Containment
• D. Eradication