View Full Fortinet NSE6_FSR-7.3 Exam Dumps and Practice Test Dumps

 

Question 161.

A FortiSOAR administrator wants a playbook to run at a defined recurring time rather than when a security record is created. Which approach is appropriate?

1. Use scheduled execution for the playbook.
   2. Change the dashboard theme.
   3. Increase connector privileges.
   4. Create a new physical network interface.

Correct Answer: 1

Explanation:

Scheduled execution is appropriate when a workflow needs to run according to a defined time-based schedule rather than in direct response to a newly created or modified security record. This can be useful for recurring data collection, maintenance, synchronization, or reporting-related automation. The workflow should still include appropriate error handling and validation. Dashboard appearance and connector privileges do not control execution timing, while a physical network interface provides connectivity rather than scheduling. The execution mechanism should match the operational trigger for the process.

Question 162.

Which operation would typically be used when a FortiSOAR playbook needs to change the status field of an existing incident?

1. Delete the module.
   2. Update the existing record.
   3. Reinstall the connector.
   4. Create a new dashboard.

Correct Answer: 2

Explanation:

Changing a field on an existing incident is an update operation. The workflow should identify the correct record and modify the required field while preserving the rest of the incident information. Record updates are commonly used to change status, assignment, severity, or other workflow-related values. Deleting a module would affect the data structure, while reinstalling a connector and creating a dashboard do not modify the existing incident. Careful record updates help keep FortiSOAR information synchronized with the actual investigation state.

Question 163.

A playbook needs to obtain only incidents that are still open and have high severity. Which capability should it use?

1. Physical disk filtering
   2. Dashboard color selection
   3. Record search or filtering with appropriate criteria
   4. Connector credential rotation

Correct Answer: 3

Explanation:

Record search or filtering can select incidents according to field values such as status and severity. Applying multiple criteria allows a workflow to operate on the specific records relevant to the use case rather than processing the entire dataset. This improves efficiency and reduces unintended actions. Disk filtering and dashboard colors are unrelated to record selection, while credential rotation addresses authentication. Search and filtering are therefore appropriate when automation needs to retrieve records matching defined operational conditions.

Question 164.

What should a playbook do before automatically closing an incident after executing containment actions?

1. Delete the execution history.
   2. Remove all associated indicators.
   3. Disable the connector.
   4. Verify that required response and closure criteria have been satisfied.

Correct Answer: 4

Explanation:

Incident closure should represent the actual state of the response process. Before automatically closing a record, the workflow should verify that required containment, investigation, documentation, or other organizational closure criteria have been completed successfully. A failed response action should not be hidden by changing the incident to a closed state. Deleting execution history or associated evidence reduces visibility, while disabling the connector is unrelated. Explicit closure criteria help keep automated incident lifecycle management accurate and auditable.

Question 165.

What is a key advantage of linking alerts to the incident created from them?

1. Analysts can preserve and navigate the relationship between source alerts and the investigation.
   2. FortiSOAR no longer requires authentication.
   3. Connector APIs become faster automatically.
   4. Physical storage capacity increases.

Correct Answer: 1

Explanation:

Linking alerts to an incident preserves the relationship between the source detection information and the investigation created to handle it. Analysts can use that context to review supporting evidence, understand why the incident exists, and navigate associated records. Playbooks can also use record relationships when automating investigation and response. Relationships do not remove authentication requirements, increase API performance automatically, or expand storage hardware. Their value is in maintaining structured investigative context across related security records.

Question 166.

A SOC wants to reduce repeated incidents generated from substantially duplicate alerts. Which capability is most relevant to the workflow design?

1. Dashboard formatting
   2. Deduplication or correlation logic
   3. Physical server clustering
   4. API password length

Correct Answer: 2

Explanation:

Deduplication or correlation logic can evaluate incoming security information and determine whether multiple alerts represent the same or related activity. Instead of creating unnecessary independent investigations, qualifying alerts can be grouped or associated according to defined criteria. The exact implementation should reflect the organization’s data sources and operational process. Dashboard formatting and server clustering do not determine alert similarity, while password length concerns credential security. Correlation can reduce noise and help analysts focus on meaningful security cases.

Question 167.

A playbook receives a JSON response containing nested objects. What must the administrator identify to use a deeply nested value later in the workflow?

1. The server’s physical serial number
   2. The analyst’s display settings
   3. The correct path or reference to the required response value
   4. The dashboard refresh interval

Correct Answer: 3

Explanation:

Structured API responses can contain nested objects and arrays. To use a particular value, the playbook must reference the correct location in the returned data structure. Administrators should inspect actual connector output and confirm field names, nesting, data types, and any required transformations. An incorrect reference can return a null or unexpected value even when the connector request itself succeeds. Hardware serial numbers, display settings, and dashboard refresh intervals have no effect on how workflow logic extracts values from JSON data.

Question 168.

Why should an automated endpoint-isolation playbook include safeguards for critical systems?

1. To increase the number of playbook executions
   2. To remove the need for endpoint authentication
   3. To guarantee all alerts become incidents
   4. To reduce the risk of disrupting essential business services.

Correct Answer: 4

Explanation:

Endpoint isolation can immediately affect business operations, particularly when the target is a critical server or other essential system. Safeguards such as asset context, exclusion criteria, additional validation, or required approval can help prevent inappropriate isolation. The specific controls should reflect organizational policy and risk. Safeguards are not intended to increase workflow volume or remove authentication. Their purpose is to balance rapid containment with protection against unnecessary disruption caused by false positives or incomplete investigative evidence.

Question 169.

Which FortiSOAR capability allows an analyst to add human-generated investigative context to a case or incident?

1. Notes or comments associated with the relevant record
   2. Physical routing tables
   3. Connector authentication tokens
   4. Disk partitions

Correct Answer: 1

Explanation:

Notes or comments can preserve analyst observations, investigation findings, decisions, and other human-generated context alongside the relevant security record. This improves collaboration when several analysts or teams participate in an investigation and helps later reviewers understand why actions were taken. Such information can complement automatically collected evidence. Routing tables, authentication tokens, and disk partitions perform unrelated technical functions. Maintaining investigative notes supports continuity, accountability, and communication throughout the incident-response lifecycle.

Question 170.

A connector action begins failing immediately after an external product is upgraded. What should the administrator investigate first?

1. Dashboard font size
   2. Connector compatibility, API behavior, and returned errors
   3. Analyst keyboard layout
   4. Incident title colors

Correct Answer: 2

Explanation:

An external product upgrade can change APIs, authentication requirements, supported operations, or response structures. If a previously working connector begins failing immediately afterward, administrators should review connector compatibility and the actual error returned by the integration. They should also determine whether the connector or affected playbooks require updates. Dashboard fonts, keyboard layouts, and title colors do not affect API behavior. Investigating the integration boundary first is appropriate because the failure coincides directly with the external system change.

Question 171.

A FortiSOAR workflow must notify a supervisor only when an incident exceeds a defined severity threshold. Which design should be used?

1. Notify the supervisor for every record.
   2. Disable incident severity.
   3. Evaluate severity with conditional logic before the notification action.
   4. Remove the notification connector.

Correct Answer: 3

Explanation:

Conditional logic allows the workflow to evaluate the incident severity and execute the notification action only when the specified threshold is met. This prevents unnecessary notifications and keeps escalation aligned with the organization’s response process. Additional criteria, such as incident type or assignment, can also be considered if required. Sending every record ignores the stated condition, while disabling severity removes useful context. Removing the integration would prevent notification entirely. Conditions provide targeted and data-driven workflow behavior.

Question 172.

What should be done when a playbook’s automatic remediation action repeatedly fails because the external API rate limit is exceeded?

1. Grant all users administrator rights.
   2. Delete all failed incidents.
   3. Ignore the API response.
   4. Adjust the workflow to handle rate limits with appropriate pacing, retry, or escalation.

Correct Answer: 4

Explanation:

API rate limits restrict how frequently an external service accepts requests. A workflow that ignores these limits may repeatedly fail and generate unnecessary load. The playbook should handle the service’s limitations appropriately, potentially through controlled retries, pacing, batching where supported, or escalation when the action cannot be completed. Granting administrator rights does not increase API limits, while deleting incidents or ignoring failures creates operational risk. Resilient automation should account for external service constraints as part of its error-handling strategy.

Question 173.

Which FortiSOAR feature can help management review incident volumes and response trends over a selected period?

1. Reports and dashboards
   2. Connector passwords
   3. Physical switch ports
   4. BIOS settings

Correct Answer: 1

Explanation:

Reports and dashboards can summarize operational information such as incident volumes, severity distributions, status, assignments, and relevant response measurements. These views help management understand workload and trends without examining each individual incident. The exact metrics should be selected according to organizational objectives. Connector passwords provide authentication, while switch ports and BIOS settings are infrastructure elements. Reporting and visualization capabilities are therefore appropriate for presenting historical and operational security information to management and SOC leadership.

Question 174.

Why should an administrator test both successful and failure paths when validating a new playbook?

1. To make the playbook file larger
   2. To verify that the workflow behaves safely under different execution outcomes
   3. To eliminate the need for connector credentials
   4. To guarantee external APIs never fail

Correct Answer: 2

Explanation:

Testing only the ideal path does not show how automation behaves when data is missing, an API is unavailable, authentication fails, or a response action is unsuccessful. Failure-path testing verifies that errors are detected and that the workflow retries, escalates, stops, or takes another safe action as designed. Testing cannot guarantee that external APIs will never fail, nor does it remove authentication requirements. Validating multiple execution paths helps prevent unexpected behavior when the workflow encounters real-world exceptions in production.

Question 175.

Which approach best protects a playbook that contains a highly privileged containment action?

1. Allow every user to execute and modify it.
   2. Use a shared unrestricted account.
   3. Restrict permissions and apply appropriate authorization controls.
   4. Disable audit visibility.

Correct Answer: 3

Explanation:

A workflow capable of performing highly privileged containment should be accessible only to authorized users and processes. Appropriate permissions, least-privilege integration accounts, and approval controls where required can reduce the risk of accidental or unauthorized execution. Shared unrestricted accounts weaken accountability, while disabling auditing makes misuse harder to investigate. Security controls should be proportional to the impact of the action. Restricting access while maintaining appropriate auditability provides stronger governance over sensitive automated response capabilities.

Question 176.

An analyst wants to determine what happened during a failed playbook execution. Which information is most useful?

1. Dashboard theme settings
   2. Physical server dimensions
   3. Analyst profile picture
   4. Playbook execution history and step-level error details

Correct Answer: 4

Explanation:

Execution history provides evidence about which workflow steps ran, which values were processed, and where the failure occurred. Step-level errors can reveal problems such as invalid input, authentication failure, unavailable services, or unexpected responses. This information allows troubleshooting to focus on the actual failure rather than making unrelated configuration changes. Dashboard themes, server dimensions, and profile pictures do not explain workflow execution. Detailed execution information is therefore central to diagnosing failed or partially completed playbooks.

Question 177.

What is the main purpose of a case-management process in FortiSOAR?

1. To organize investigation and response activities around security records and associated work
   2. To configure physical firewall interfaces
   3. To replace all security products
   4. To increase server clock speed

Correct Answer: 1

Explanation:

Case management helps organize the information and activities associated with security investigations. This can include relevant records, assignments, tasks, evidence, notes, status, and other context required to move work through the incident lifecycle. Automation can support the process, while analysts retain visibility and responsibility where necessary. Case management does not configure physical interfaces, replace every security technology, or change hardware performance. Its purpose is to provide a structured operational framework for investigating and responding to security events.

Question 178.

A playbook must send a ticket to an external IT service-management platform. What is normally required?

1. A new physical disk
   2. A configured connector with the required operation and permissions
   3. A dashboard without filters
   4. A different FortiSOAR login page

Correct Answer: 2

Explanation:

Integration with an external ticketing or IT service-management platform normally requires an appropriate connector configured with the endpoint, authentication, and permissions needed for the intended operation. The playbook can then invoke the connector to create or update a ticket and pass relevant incident information. A physical disk and login-page customization are unrelated, while dashboards only display information. The connector provides the application-level communication required for coordinated ticket creation as part of an automated security workflow.

Question 179.

Which approach should a playbook use when multiple response actions depend on a common enrichment result?

1. Request the same enrichment repeatedly without reason.
   2. Ignore the enrichment output.
   3. Store or pass the result so subsequent steps can reuse it.
   4. Create a new user for every response action.

Correct Answer: 3

Explanation:

When several workflow decisions depend on the same enrichment result, the data should be retained or passed to subsequent steps so it can be reused. This avoids unnecessary duplicate API requests and helps maintain consistency because each decision evaluates the same evidence. Repeating external calls can waste resources and may contribute to rate-limit problems. Ignoring the result defeats the purpose of enrichment, while creating users is unrelated. Efficient data reuse is an important principle when designing multi-step automation.

Question 180.

What is the most appropriate practice after changing the data model or fields used by several production playbooks?

1. Assume all existing playbooks will adapt automatically.
   2. Delete historical records immediately.
   3. Disable all connectors permanently.
   4. Identify dependent workflows and test their field references and behavior.

Correct Answer: 4

Explanation:

Changes to fields or data structures can affect playbooks that reference those values for conditions, mappings, connector inputs, or record updates. Administrators should identify dependent automation and verify that the expected fields remain available and correctly interpreted. Testing should cover relevant workflow paths before relying on the modified configuration in production. Assuming automatic adaptation can result in silent failures, while deleting historical records or disabling connectors does not address dependency problems. Dependency-aware testing helps maintain reliable automation after data-model changes.