{"id":20306,"date":"2026-09-23T12:30:44","date_gmt":"2026-09-23T12:30:44","guid":{"rendered":"https:\/\/www.examlabs.com\/certification\/?p=20306"},"modified":"2026-09-23T12:30:44","modified_gmt":"2026-09-23T12:30:44","slug":"fortinet-nse7_soc_ar-7-6-practice-test-questions-and-exam-dumps-part10-q181-200","status":"publish","type":"post","link":"https:\/\/www.examlabs.com\/certification\/fortinet-nse7_soc_ar-7-6-practice-test-questions-and-exam-dumps-part10-q181-200\/","title":{"rendered":"Fortinet NSE7_SOC_AR-7.6 Practice Test Questions and Exam Dumps Part10 Q181-200"},"content":{"rendered":"

View Full <\/b>Fortinet NSE7_SOC_AR-7.6 Exam Dumps<\/b><\/a> and Practice Test Dumps.<\/b><\/p>\n


\n<\/b>Q181. Why is accurate time synchronization important across systems sending events to FortiSIEM?<\/b><\/p>\n

    \n
  1. <\/b> It automatically increases incident severity<\/span><\/li>\n
  2. <\/b> It replaces event normalization<\/span><\/li>\n
  3. <\/b> It allows events from different systems to be correlated and ordered accurately during investigations<\/span><\/li>\n
  4. <\/b> It prevents FortiSOAR connectors from timing out<\/span><\/li>\n<\/ol>\n

    Correct Answer: 3. It allows events from different systems to be correlated and ordered accurately during investigations<\/b><\/p>\n

    Explanation:<\/b><\/p>\n

    Accurate timestamps are essential when FortiSIEM correlates activity from firewalls, endpoints, identity systems, servers, and other data sources. If device clocks differ significantly, related events can appear in the wrong sequence, making an attack timeline difficult to reconstruct and potentially causing time-sensitive correlation rules to behave incorrectly. Consistent time synchronization helps analysts determine what happened first, what followed, and whether events occurred within expected rule windows. Time synchronization does not replace parsing or normalization and has no direct effect on FortiSOAR connector permissions or incident severity.<\/span><\/p>\n

    Q182. A critical security device stops sending logs to FortiSIEM. What should the SOC do FIRST?<\/b><\/p>\n

      \n
    1. <\/b> Verify source connectivity, collection status, and whether events are still reaching the expected FortiSIEM ingestion path<\/span><\/li>\n
    2. <\/b> Disable all correlation rules<\/span><\/li>\n
    3. <\/b> Delete the device from asset inventory<\/span><\/li>\n
    4. <\/b> Close all incidents related to that device<\/span><\/li>\n<\/ol>\n

      Correct Answer: 1. Verify source connectivity, collection status, and whether events are still reaching the expected FortiSIEM ingestion path<\/b><\/p>\n

      Explanation:<\/b><\/p>\n

      A sudden loss of telemetry creates a detection blind spot. The first step is to determine where the event flow stopped. Administrators should verify that the source is still generating logs, network connectivity to the collection infrastructure is healthy, relevant collection services are operational, and no configuration change interrupted forwarding. Deleting the asset or disabling rules would worsen visibility. Once ingestion is restored, the SOC may also need to review the period of missing telemetry for potential undetected activity. Reliable data collection is foundational to effective SIEM detection and investigation.<\/span><\/p>\n

      Q183. What is the primary purpose of severity within a FortiSIEM incident rule?<\/b><\/p>\n

        \n
      1. <\/b> To determine how long logs are retained<\/span><\/li>\n
      2. <\/b> To select which FortiSOAR connector is installed<\/span><\/li>\n
      3. <\/b> To change the original source IP<\/span><\/li>\n
      4. <\/b> To communicate the relative importance or risk associated with the detected condition<\/span><\/li>\n<\/ol>\n

        Correct Answer: 4. To communicate the relative importance or risk associated with the detected condition<\/b><\/p>\n

        Explanation:<\/b><\/p>\n

        Incident severity helps analysts prioritize work by expressing the expected importance of the detected behavior. Severity should reflect factors such as the detection use case, confidence, asset criticality, potential impact, and organizational risk model. A rule that detects highly suspicious administrative abuse may deserve a different severity than one identifying lower-confidence reconnaissance. Severity does not determine storage retention or modify event fields. It should also be reviewed during tuning because incorrectly classified incidents can either overwhelm analysts or cause serious threats to receive insufficient attention.<\/span><\/p>\n

        Q184. A FortiSIEM rule triggers when a user authenticates from a source country never previously associated with that account. What type of detection approach is this?<\/b><\/p>\n

          \n
        1. <\/b> Signature-only malware detection<\/span><\/li>\n
        2. <\/b> Behavioral or contextual anomaly detection<\/span><\/li>\n
        3. <\/b> Static backup validation<\/span><\/li>\n
        4. <\/b> Log deletion monitoring only<\/span><\/li>\n<\/ol>\n

          Correct Answer: 2. Behavioral or contextual anomaly detection<\/b><\/p>\n

          Explanation:<\/b><\/p>\n

          The rule evaluates the event relative to expected or previously observed context rather than relying only on a known malicious signature. A login from an unfamiliar geographic region can be suspicious because it differs from normal account behavior. However, travel, VPN infrastructure, cloud services, and inaccurate IP geolocation can all produce legitimate exceptions. Therefore, contextual detections should normally lead to investigation rather than automatic conclusions. Analysts should correlate device, authentication method, source reputation, timing, user behavior, and subsequent activity before deciding whether the account is compromised.<\/span><\/p>\n

          Q185. Why should a FortiSIEM correlation rule use the narrowest reliable conditions that still detect the intended behavior?<\/b><\/p>\n

            \n
          1. <\/b> To reduce unrelated matches while preserving meaningful detection coverage<\/span><\/li>\n
          2. <\/b> To guarantee zero false negatives<\/span><\/li>\n
          3. <\/b> To eliminate the need for tuning<\/span><\/li>\n
          4. <\/b> To stop FortiSIEM from storing raw events<\/span><\/li>\n<\/ol>\n

            Correct Answer: 4. To reduce unrelated matches while preserving meaningful detection coverage<\/b><\/p>\n

            Explanation:<\/b><\/p>\n

            Good detection engineering attempts to maximize useful signal while minimizing predictable benign noise. Conditions should represent the malicious or suspicious behavior accurately without being unnecessarily broad. Overly broad logic can generate large numbers of false positives, while overly narrow logic can miss real attacks. Effective rules often combine event type, entity relationships, thresholds, time windows, asset context, or exclusions. No rule can guarantee zero false negatives, and ongoing tuning remains necessary as the environment changes. FortiSIEM incident-rule configuration is one of the official NSE 7 Security Operations exam skills.<\/span><\/p>\n

            Q186. What is the BEST reason to compare FortiSIEM incidents against change-management records?<\/b><\/p>\n

              \n
            1. <\/b> Approved changes can explain activity that appears unusual but is legitimate<\/span><\/li>\n
            2. <\/b> Change records prove that no security incident occurred<\/span><\/li>\n
            3. <\/b> Every incident caused by a change should be deleted<\/span><\/li>\n
            4. <\/b> Change management replaces security monitoring<\/span><\/li>\n<\/ol>\n

              Correct Answer: 2. Approved changes can explain activity that appears unusual but is legitimate<\/b><\/p>\n

              Explanation:<\/b><\/p>\n

              Maintenance, software deployment, configuration updates, and administrative changes can generate behavior that resembles malicious activity. Comparing suspicious events with approved change records can help analysts determine whether the activity is expected. However, an approved change does not automatically make every related event safe; attackers can also operate during maintenance windows or abuse administrative tools. Analysts should validate the identity, timing, systems, and actions involved. Change-management context is one of several sources that can improve triage accuracy and reduce unnecessary escalation without creating blind spots.<\/span><\/p>\n

              Q187. A FortiSIEM query must identify events where either of two known malicious domains appears. Which logical operator is MOST appropriate between the two domain conditions?<\/b><\/p>\n

                \n
              1. <\/b> OR<\/span><\/li>\n
              2. <\/b> AND only<\/span><\/li>\n
              3. <\/b> NOT<\/span><\/li>\n
              4. <\/b> XOR is always required<\/span><\/li>\n<\/ol>\n

                Correct Answer: 1. OR<\/b><\/p>\n

                Explanation:<\/b><\/p>\n

                OR is appropriate when the query should return an event that matches either of two specified values. If the analyst searches for activity involving malicious-domain-A OR malicious-domain-B, events containing either domain can be returned. AND would generally require both conditions to be true simultaneously, which may incorrectly exclude relevant evidence. NOT is used for exclusions. Understanding Boolean logic is essential when constructing FortiSIEM searches because incorrect operators can produce too much noise or hide important evidence. Building event-log queries is explicitly included in the current exam objectives.<\/span><\/p>\n

                Q188. Why is querying a specific indicator across a wider historical period useful after an incident is confirmed?<\/b><\/p>\n

                  \n
                1. <\/b> It automatically blocks the indicator<\/span><\/li>\n
                2. <\/b> It changes the event severity<\/span><\/li>\n
                3. <\/b> It can reveal earlier activity and identify additional affected systems that predate the original alert<\/span><\/li>\n
                4. <\/b> It removes the need for endpoint investigation<\/span><\/li>\n<\/ol>\n

                  Correct Answer: 3. It can reveal earlier activity and identify additional affected systems that predate the original alert<\/b><\/p>\n

                  Explanation:<\/b><\/p>\n

                  The event that triggered an incident may occur long after the attacker first entered the environment. Searching the confirmed indicator over a wider historical range can reveal earlier communications, additional hosts, repeated attempts, or activity associated with other accounts. This helps establish the true incident timeline and scope. The indicator should not be treated as the only source of evidence, because attackers may change infrastructure or use multiple techniques. Historical querying is therefore a pivot that complements behavioral analysis, endpoint investigation, and threat intelligence.<\/span><\/p>\n

                  Q189. What is the purpose of creating a clear incident disposition such as true positive or benign activity?<\/b><\/p>\n

                    \n
                  1. <\/b> To document the analyst\u2019s conclusion and support consistent reporting, tuning, and follow-up<\/span><\/li>\n
                  2. <\/b> To delete all evidence associated with the incident<\/span><\/li>\n
                  3. <\/b> To prevent future incidents from being created<\/span><\/li>\n
                  4. <\/b> To modify the underlying security product automatically<\/span><\/li>\n<\/ol>\n

                    Correct Answer: 1. To document the analyst\u2019s conclusion and support consistent reporting, tuning, and follow-up<\/b><\/p>\n

                    Explanation:<\/b><\/p>\n

                    A disposition records the outcome of the investigation and helps the SOC distinguish confirmed threats from benign or incorrectly detected activity. Consistent dispositions support metrics, detection-rule tuning, post-incident reviews, and management reporting. For example, repeated benign incidents with the same cause may reveal a rule that needs refinement. A true positive may identify opportunities for stronger detection or response automation. Disposition should be based on evidence and should not result in deleting useful historical data. It is an important part of maintaining a disciplined incident-management process.<\/span><\/p>\n

                    Q190. A FortiSIEM incident includes several indicators that are not yet classified. What is the BEST next step?<\/b><\/p>\n

                      \n
                    1. <\/b> Assume all indicators are malicious<\/span><\/li>\n
                    2. <\/b> Delete unclassified indicators<\/span><\/li>\n
                    3. <\/b> Close the incident because classification is unavailable<\/span><\/li>\n
                    4. <\/b> Enrich and correlate the indicators with available internal and external context**<\/span><\/li>\n<\/ol>\n

                      Correct Answer: 4. Enrich and correlate the indicators with available internal and external context<\/b><\/p>\n

                      Explanation:<\/b><\/p>\n

                      Unknown indicators require additional context rather than an automatic malicious or benign classification. Analysts can examine reputation services, historical sightings, asset relationships, endpoint behavior, DNS data, network connections, and other evidence. FortiSOAR playbooks can automate much of this enrichment through connectors, while analysts interpret the resulting information. Intelligence can be incomplete or stale, so local evidence remains important. The objective is to determine how the indicators relate to observed behavior and whether they support or weaken the hypothesis that a genuine compromise occurred.<\/span><\/p>\n

                      Q191. What is the PRIMARY purpose of threat-hunting notebooks or documented hunt records?<\/b><\/p>\n

                        \n
                      1. <\/b> To replace FortiSIEM data retention<\/span><\/li>\n
                      2. <\/b> To record the hypothesis, searches, evidence, findings, and conclusions so the hunt is repeatable<\/span><\/li>\n
                      3. <\/b> To hide unsuccessful hunts<\/span><\/li>\n
                      4. <\/b> To prevent queries from being modified<\/span><\/li>\n<\/ol>\n

                        Correct Answer: 2. To record the hypothesis, searches, evidence, findings, and conclusions so the hunt is repeatable<\/b><\/p>\n

                        Explanation:<\/b><\/p>\n

                        Documenting a threat hunt creates a reusable record of what the hunter attempted and what was learned. It should capture the hypothesis, relevant data sources, queries, pivots, observations, limitations, and final conclusions. Even a hunt that finds no malicious activity can provide useful information about detection coverage or data gaps. Good documentation enables other analysts to reproduce the work, refine the hypothesis, or turn useful findings into detections. Threat-hunting process and data analysis are explicitly included in Fortinet\u2019s current exam objectives.<\/span><\/p>\n

                        Q192. A threat hunt identifies suspicious behavior but available telemetry is insufficient to prove or disprove the hypothesis. What should the SOC do?<\/b><\/p>\n

                          \n
                        1. <\/b> Declare the hypothesis confirmed<\/span><\/li>\n
                        2. <\/b> Close the hunt without recording the limitation<\/span><\/li>\n
                        3. <\/b> Document the visibility gap and consider onboarding or improving the required data source<\/span><\/li>\n
                        4. <\/b> Delete existing telemetry<\/span><\/li>\n<\/ol>\n

                          Correct Answer: 3. Document the visibility gap and consider onboarding or improving the required data source<\/b><\/p>\n

                          Explanation:<\/b><\/p>\n

                          A hunt can reveal security-visibility problems even when it does not identify an active attacker. If the available logs cannot answer an important question, the SOC should document that limitation and determine whether additional telemetry, parsing, retention, or endpoint\/network visibility is required. This creates an opportunity to improve future detection and investigation capability. Analysts should not claim a hypothesis is confirmed when evidence is insufficient. Threat hunting is evidence-driven, and identifying data gaps is a valid and valuable outcome of the process.<\/span><\/p>\n

                          Q193. Why might FortiSOAR use a queue specifically for incidents awaiting external-team action?<\/b><\/p>\n

                            \n
                          1. <\/b> To make pending cases visible and distinguish them from cases actively worked by SOC analysts<\/span><\/li>\n
                          2. <\/b> To delete incidents that require another team<\/span><\/li>\n
                          3. <\/b> To change FortiSIEM rule logic<\/span><\/li>\n
                          4. <\/b> To disable incident ownership<\/span><\/li>\n<\/ol>\n

                            Correct Answer: 4. To make pending cases visible and distinguish them from cases actively worked by SOC analysts<\/b><\/p>\n

                            Explanation:<\/b><\/p>\n

                            Some incidents depend on action from system owners, identity teams, legal staff, cloud administrators, or other external groups. A dedicated queue or workflow state can make these dependencies visible while preserving ownership and escalation. This helps prevent cases from appearing abandoned and enables the SOC to track how long they remain blocked. Queue design should support operational clarity rather than hiding work. Fortinet explicitly includes queues and shifts for workload management in the current NSE 7 Security Operations Architect objectives.<\/span><\/p>\n

                            Q194. Why should queue membership and shift coverage be reviewed periodically?<\/b><\/p>\n

                              \n
                            1. <\/b> To ensure workload-routing rules still reflect current staffing and team responsibilities<\/span><\/li>\n
                            2. <\/b> To increase FortiSIEM event volume<\/span><\/li>\n
                            3. <\/b> To improve malware signatures<\/span><\/li>\n
                            4. <\/b> To change connector API responses<\/span><\/li>\n<\/ol>\n

                              Correct Answer: 1. To ensure workload-routing rules still reflect current staffing and team responsibilities<\/b><\/p>\n

                              Explanation:<\/b><\/p>\n

                              SOC teams change over time. Analysts move roles, schedules change, new specialties are created, and responsibilities can shift between teams. If queue membership and shifts are not maintained, incidents may be assigned to unavailable or inappropriate personnel. Periodic reviews help ensure that high-severity or specialized cases reach people who can act on them. This is an operational-maintenance task rather than a SIEM detection or connector function. Fortinet includes queues and shifts specifically because effective incident handling requires reliable coordination of human workload.<\/span><\/p>\n

                              Q195. A FortiSOAR playbook should run automatically only when a new incident is created from a specific source. Which element is most important?<\/b><\/p>\n

                                \n
                              1. <\/b> A trigger with conditions matching the appropriate record-creation event and source criteria<\/span><\/li>\n
                              2. <\/b> A Jinja filter that changes every incident title<\/span><\/li>\n
                              3. <\/b> A queue without any trigger<\/span><\/li>\n
                              4. <\/b> A manual connector test<\/span><\/li>\n<\/ol>\n

                                Correct Answer: 2. A trigger with conditions matching the appropriate record-creation event and source criteria<\/b><\/p>\n

                                Explanation:<\/b><\/p>\n

                                The trigger defines when a playbook starts. If the workflow should run only for newly created incidents from a particular source, the trigger must identify the relevant creation event and include criteria that distinguish the desired source. This prevents the automation from running against unrelated incidents or repeatedly executing after ordinary record updates. Additional conditions can be used later in the workflow, but correct trigger design is the first control. Fortinet\u2019s current exam explicitly includes configuring FortiSOAR playbooks.<\/span><\/p>\n

                                Q196. A playbook must perform three independent enrichment lookups that do not depend on one another. What is a potential design benefit of executing them in parallel where supported?<\/b><\/p>\n

                                  \n
                                1. <\/b> It can reduce total enrichment time because independent lookups do not need to wait for one another<\/span><\/li>\n
                                2. <\/b> Parallel execution guarantees every external API will succeed<\/span><\/li>\n
                                3. <\/b> It removes the need for connector credentials<\/span><\/li>\n
                                4. <\/b> It makes error handling unnecessary<\/span><\/li>\n<\/ol>\n

                                  Correct Answer: 3. It can reduce total enrichment time because independent lookups do not need to wait for one another<\/b><\/p>\n

                                  Explanation:<\/b><\/p>\n

                                  When enrichment actions are independent, sequential execution can add unnecessary delay because each lookup waits for the previous one to finish. Parallel execution can reduce total workflow time, especially when external services respond slowly. However, each branch still needs proper error handling, credentials, rate-limit awareness, and result processing. Parallel design should not be used when one action depends on the output of another. Playbook architects should understand data dependencies before deciding whether steps can safely execute independently.<\/span><\/p>\n

                                  Q197. Why should a connector credential be rotated when exposure is suspected?<\/b><\/p>\n

                                    \n
                                  1. <\/b> To reduce the risk that an unauthorized party can continue using the compromised credential<\/span><\/li>\n
                                  2. <\/b> To increase threat-intelligence accuracy<\/span><\/li>\n
                                  3. <\/b> To change FortiSIEM query syntax<\/span><\/li>\n
                                  4. <\/b> To clear all playbook history<\/span><\/li>\n<\/ol>\n

                                    Correct Answer: 1. To reduce the risk that an unauthorized party can continue using the compromised credential<\/b><\/p>\n

                                    Explanation:<\/b><\/p>\n

                                    Connector credentials may grant access to powerful external systems, so suspected exposure should be treated seriously. Rotating or revoking the credential limits the opportunity for continued unauthorized use. Administrators should then update FortiSOAR securely, validate the connector, and review logs for suspicious actions performed with the old credential. Least privilege can reduce the impact of compromise, but rotation remains important when secrecy can no longer be trusted. Credential hygiene is a fundamental part of maintaining secure SOAR integrations.<\/span><\/p>\n

                                    Q198. A playbook receives an array of indicators and must process only unique values. Which type of Jinja operation is appropriate?<\/b><\/p>\n

                                      \n
                                    1. <\/b> An operation that intentionally duplicates every value<\/span><\/li>\n
                                    2. <\/b> A filter or transformation that produces a unique set\/list before downstream processing<\/span><\/li>\n
                                    3. <\/b> A connector-permission change<\/span><\/li>\n
                                    4. <\/b> A shift reassignment<\/span><\/li>\n<\/ol>\n

                                      Correct Answer: 3. A filter or transformation that produces a unique set\/list before downstream processing<\/b><\/p>\n

                                      Explanation:<\/b><\/p>\n

                                      Duplicate indicator values can cause unnecessary API calls, repeated tasks, or duplicate containment attempts. Before downstream processing, the playbook can use Jinja-based transformation to reduce the collection to unique values. The exact expression depends on the runtime structure, but the design goal is to normalize the list before enrichment or response. Data manipulation does not require changing connector permissions or analyst scheduling. Fortinet explicitly lists manipulation using Jinja filters as part of the current playbook-development exam objectives.<\/span><\/p>\n

                                      Q199. During debugging, one playbook branch never executes even though the developer expects it to. What should be examined first?<\/b><\/p>\n

                                        \n
                                      1. <\/b> The condition input values, operators, and execution history leading to that branch<\/span><\/li>\n
                                      2. <\/b> FortiSIEM storage utilization only<\/span><\/li>\n
                                      3. <\/b> The SOC building location<\/span><\/li>\n
                                      4. <\/b> The analyst shift name<\/span><\/li>\n<\/ol>\n

                                        Correct Answer: 4. The condition input values, operators, and execution history leading to that branch<\/b><\/p>\n

                                        Explanation:<\/b><\/p>\n

                                        If a branch is never selected, the problem is often in the condition that controls it. Developers should inspect the runtime values, their data types, the comparison operator, preceding Jinja transformations, and execution history to see why the condition evaluates differently than expected. A field may be null, represented as text instead of a number, or mapped from the wrong record property. Step-level troubleshooting is more effective than changing unrelated infrastructure. Debugging and troubleshooting FortiSOAR playbooks is explicitly listed in Fortinet\u2019s exam blueprint.<\/span><\/p>\n

                                        Q200. What is the BEST reason to require change control for production FortiSOAR playbooks?<\/b><\/p>\n

                                          \n
                                        1. <\/b> To prevent playbooks from ever being updated<\/span><\/li>\n
                                        2. <\/b> To ensure workflow changes are reviewed, tested, documented, and deployed in a controlled manner<\/span><\/li>\n
                                        3. <\/b> To eliminate connector troubleshooting<\/span><\/li>\n
                                        4. <\/b> To reduce FortiSIEM data-source coverage<\/span><\/li>\n<\/ol>\n

                                          Correct Answer: 2. To ensure workflow changes are reviewed, tested, documented, and deployed in a controlled manner<\/b><\/p>\n

                                          Explanation:<\/b><\/p>\n

                                          Production playbooks can modify incidents, disable accounts, block indicators, isolate endpoints, and interact with external platforms. A seemingly small logic change can therefore have substantial consequences. Change control provides a structured process for reviewing the modification, validating dependencies, testing representative scenarios, documenting expected behavior, and deploying safely. It also makes rollback and auditing easier when a change creates unintended effects. Change control does not prevent improvement; it allows automation to evolve without introducing avoidable operational risk.<\/span><\/p>\n","protected":false},"excerpt":{"rendered":"

                                          View Full Fortinet NSE7_SOC_AR-7.6 Exam Dumps and Practice Test Dumps. Q181. Why is accurate time synchronization important across systems sending events to FortiSIEM? It automatically increases incident severity It replaces event normalization It allows events from different systems to be correlated and ordered accurately during investigations It prevents FortiSOAR connectors from timing out Correct Answer: […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":[],"categories":[1648,1647],"tags":[],"_links":{"self":[{"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/posts\/20306"}],"collection":[{"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/comments?post=20306"}],"version-history":[{"count":1,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/posts\/20306\/revisions"}],"predecessor-version":[{"id":20307,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/posts\/20306\/revisions\/20307"}],"wp:attachment":[{"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/media?parent=20306"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/categories?post=20306"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.examlabs.com\/certification\/wp-json\/wp\/v2\/tags?post=20306"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}