View Full Fortinet NSE6_FSR-7.3 Exam Dumps and Practice Test Dumps

 

Question 261.

A FortiSOAR administrator needs to preserve a relationship between a phishing incident and the email indicators extracted during investigation. What should be used?

1. Related records or record relationships
   2. Connector credential rotation
   3. Dashboard scheduling
   4. Physical network routes

Correct Answer: 1

Explanation:

Record relationships allow FortiSOAR to maintain logical associations among security objects. Linking extracted indicators with the phishing incident preserves investigative context and makes it easier for analysts and playbooks to navigate between related information. These relationships can also help identify indicators associated with multiple investigations. Credential rotation manages authentication, dashboard scheduling controls presentation-related activity, and network routes concern connectivity. Record relationships are therefore appropriate when related security data must remain connected throughout an investigation.

Question 262.

A playbook must retrieve information from an external vulnerability-management platform. What is normally required?

1. A new dashboard
   2. A configured connector with suitable authentication and permissions
   3. A separate FortiSOAR deployment
   4. A new incident status

Correct Answer: 2

Explanation:

A connector enables FortiSOAR to communicate with an external platform through its supported integration interface. It must be configured with the necessary connection information, authentication, and permissions for the operations the workflow needs to perform. Once configured, playbooks can invoke appropriate actions and process returned information. A dashboard visualizes data but does not establish API communication, while a separate deployment or new incident status is unnecessary. Correct connector configuration is fundamental to reliable external integration.

Question 263.

A workflow must send a notification only when both incident severity is Critical and the affected asset is classified as high value. What should be used?

1. Physical routing
   2. Report formatting
   3. Conditional logic evaluating both criteria
   4. Dashboard resizing

Correct Answer: 3

Explanation:

Conditional logic can evaluate multiple pieces of record context before deciding whether the notification action should run. The workflow can check both severity and asset classification and continue to the notification step only when the required combination is satisfied. This prevents unnecessary escalation for records that do not meet the defined business rule. Physical routing and dashboard resizing are unrelated, while reports present information rather than control playbook execution. Conditions provide the appropriate mechanism for multi-criteria workflow decisions.

Question 264.

A playbook attempts to block an IP address but receives an uncertain response from the external firewall platform. What should it do?

1. Assume the block succeeded.
   2. Close the incident immediately.
   3. Delete the connector output.
   4. Preserve the result and route the action for verification or defined exception handling.

Correct Answer: 4

Explanation:

An uncertain response should not be interpreted automatically as successful containment. The workflow should preserve the returned information and follow an exception path that verifies the actual firewall state, retries safely if appropriate, or escalates to an analyst. Closing the incident could leave a threat active while incorrectly indicating successful response. Deleting output also removes evidence useful for troubleshooting. Explicit handling of uncertain outcomes helps ensure that automated containment status reflects what actually occurred.

Question 265.

What is the primary purpose of an incident status field in a FortiSOAR case-management process?

1. To represent the current stage or state of the incident lifecycle
   2. To authenticate external APIs
   3. To configure physical interfaces
   4. To increase storage capacity

Correct Answer: 1

Explanation:

Incident status provides structured information about where a case currently stands in its lifecycle. Depending on the organization’s process, statuses can help distinguish records that require investigation, are being worked, are awaiting another activity, or have completed the response process. Playbooks, filters, dashboards, and reports can use this field to support operations. It does not authenticate APIs, configure networking, or expand storage. Accurate status information helps analysts and automation coordinate incident progression consistently.

Question 266.

A connector operation succeeds during manual testing but fails only when invoked by a playbook. What should be investigated?

1. The monitor resolution
   2. The playbook inputs, mappings, execution context, and returned error
   3. The dashboard background
   4. The server chassis size

Correct Answer: 2

Explanation:

Successful manual testing indicates that basic connectivity, authentication, and the connector operation may be functional. The difference is likely related to values or context supplied by the playbook. Administrators should compare the manual test inputs with the workflow inputs, inspect dynamic field mappings, and review execution errors. Null values or incorrectly formatted parameters are common causes. Dashboard appearance, monitor resolution, and chassis dimensions do not influence connector action inputs. Comparing execution contexts helps isolate the actual problem.

Question 267.

A playbook receives twenty indicators and needs to perform the same lookup for each one. What is the most efficient design?

1. Create twenty separate user accounts.
   2. Build twenty dashboards.
   3. Use iterative processing.
   4. Restart FortiSOAR after each lookup.

Correct Answer: 3

Explanation:

Iterative processing lets a workflow apply the same action to each item in a collection. The playbook can process all twenty indicators without requiring twenty manually duplicated branches. This also allows the same workflow to handle different collection sizes in future executions. Separate user accounts and dashboards do not perform indicator analysis, and restarting the platform after each lookup would be unnecessary. Iteration improves scalability, maintainability, and consistency when processing collections of similar security objects.

Question 268.

Which approach best protects an automated account-disable action from acting on an incorrect user?

1. Disable audit logging.
   2. Skip identity verification.
   3. Give the connector unrestricted permissions.
   4. Validate the target identity and apply required safeguards before execution.

Correct Answer: 4

Explanation:

Account disablement can disrupt legitimate users, so the workflow should verify that the intended target has been correctly identified. Additional safeguards can include contextual checks, protected-account exclusions, confidence criteria, or human approval according to organizational policy. Skipping validation increases the chance of disabling the wrong account, while unrestricted connector privileges increase the potential impact of an error. Disabling auditing further reduces accountability. Target validation helps make automated identity-response actions safer and more reliable.

Question 269.

Which FortiSOAR capability is most appropriate for presenting trends in incident handling to SOC management?

1. Reports and dashboards
   2. Connector passwords
   3. API tokens
   4. Manual approvals

Correct Answer: 1

Explanation:

Reports and dashboards can summarize incident data and operational measurements for management. Depending on configuration, they can present trends in incident volumes, severity, status, workload, or response performance over selected periods. These views help stakeholders understand SOC operations without reviewing individual records. Connector passwords and API tokens provide authentication, while manual approvals control workflow progression. Reporting and visualization features are therefore the appropriate capabilities for communicating operational trends and performance information.

Question 270.

A service account used by FortiSOAR can both query and delete records, but the playbook only performs queries. What should the administrator do?

1. Grant additional administrative privileges.
   2. Remove unnecessary delete permissions where operationally possible.
   3. Disable authentication.
   4. Share the account with all analysts.

Correct Answer: 2

Explanation:

The principle of least privilege recommends limiting an account to the permissions necessary for its intended purpose. If FortiSOAR only queries the external platform, deletion rights create unnecessary risk. Removing those privileges reduces the potential impact of credential compromise or incorrect automation. Adding privileges or sharing the account would increase exposure, while disabling authentication is insecure. Connector service accounts should be reviewed periodically so their access remains aligned with the operations actually required by production workflows.

Question 271.

A connector response contains a list of objects, each with a reputation value. What must the playbook do to evaluate each object’s reputation individually?

1. Increase physical memory.
   2. Change the dashboard theme.
   3. Iterate through the returned objects and reference each reputation value.
   4. Create a new role for every object.

Correct Answer: 3

Explanation:

When an API returns a collection of structured objects, the workflow can iterate through the collection and reference the relevant field within each item. This allows the playbook to evaluate each reputation result independently and take appropriate action. The administrator should verify the returned data structure so the correct field path is used. Physical memory, dashboard themes, and user roles do not provide collection processing. Iteration combined with accurate field references enables scalable handling of structured connector responses.

Question 272.

An automated remediation workflow depends on three external systems, and one is unavailable. What is the safest design?

1. Pretend the unavailable action succeeded.
   2. Close the incident regardless.
   3. Remove all execution records.
   4. Detect the dependency failure and follow the defined recovery or escalation path.

Correct Answer: 4

Explanation:

A multi-system workflow should recognize when a required dependency fails and avoid claiming that the overall remediation completed successfully. Depending on the design, the workflow can retry, use an approved alternative, create a manual task, or escalate the incident. Preserving execution information helps analysts determine which actions completed and which remain outstanding. Pretending success or closing the incident can leave unresolved risk hidden. Dependency-aware error handling makes coordinated automation more trustworthy when external services become unavailable.

Question 273.

Why are playbook execution records valuable during troubleshooting?

1. They provide visibility into workflow steps, data, errors, and outcomes.
   2. They increase external API limits.
   3. They replace all incident records.
   4. They automatically fix connector credentials.

Correct Answer: 1

Explanation:

Execution records help administrators understand what occurred during a specific workflow run. They can reveal which steps executed, what data was supplied or returned, where an error occurred, and whether subsequent actions completed. This evidence is particularly useful when reproducing intermittent failures or investigating unexpected branches. Execution records do not increase API limits, replace incidents, or automatically repair authentication. Their value lies in providing operational visibility that supports debugging, auditing, and continuous improvement of automation.

Question 274.

A SOC wants analysts to perform enrichment actions but not modify system-wide FortiSOAR settings. What should be configured?

1. Shared administrator credentials
   2. A role with permissions appropriate to analyst responsibilities
   3. Anonymous access
   4. Unrestricted configuration privileges

Correct Answer: 2

Explanation:

A role should grant analysts the capabilities required for investigation while withholding system-wide administrative privileges they do not need. This supports least privilege and separation of duties. Analysts may be allowed to view and update relevant records or execute approved enrichment workflows without being able to change global configuration. Shared or unrestricted administrator access creates unnecessary risk, while anonymous access weakens security and accountability. Role-based permissions allow access to be aligned with actual operational responsibilities.

Question 275.

A playbook must choose one of several response paths based on incident category. Which capability provides this behavior?

1. Physical storage expansion
   2. Report scheduling
   3. Conditional branching
   4. Connector credential rotation

Correct Answer: 3

Explanation:

Conditional branching allows a workflow to inspect the incident category and select the response path appropriate to that classification. For example, phishing, malware, and unauthorized-access incidents may require different enrichment tools, notifications, or containment actions. A single playbook can therefore adapt its behavior based on structured record data. Storage expansion, report scheduling, and credential rotation do not control workflow decisions. Conditional logic provides the flexible decision structure needed for category-specific response processes.

Question 276.

A playbook uses a third-party API that allows only a limited number of requests per minute. How should the workflow be designed?

1. Ignore API errors and continue indefinitely.
   2. Send all possible requests simultaneously.
   3. Disable connector logging.
   4. Respect rate limits through appropriate pacing, batching, or retry behavior.

Correct Answer: 4

Explanation:

API rate limits must be considered when designing automation that can generate many requests. Appropriate pacing, batching where supported, and controlled retry behavior can prevent unnecessary failures and reduce pressure on the external service. The workflow should also recognize rate-limit responses and escalate when requests cannot be completed within acceptable operational constraints. Sending requests without control may repeatedly exceed the limit. Disabling logging would make troubleshooting harder. Rate-aware design improves the reliability of connector-driven automation.

Question 277.

Which capability enables FortiSOAR to combine automated actions with human decisions in one incident-response process?

1. Playbooks containing automated steps and manual tasks or approvals
   2. Physical RAID configuration
   3. Dashboard themes
   4. Disk partitioning

Correct Answer: 1

Explanation:

FortiSOAR playbooks can combine automated connector operations and data processing with human tasks or approvals. This allows routine enrichment and low-risk actions to be automated while preserving analyst judgment for ambiguous or high-impact decisions. Such human-in-the-loop workflows can balance response speed with operational control. RAID and disk partitioning are storage concepts, while dashboard themes concern presentation. Playbooks provide the workflow framework needed to coordinate both automated and human activities within a security process.

Question 278.

An external platform changes the format of a timestamp returned to FortiSOAR. What should the administrator check?

1. Physical network cables
   2. Playbook parsing, mappings, and conditions that depend on the timestamp
   3. Dashboard colors
   4. Analyst monitor settings

Correct Answer: 2

Explanation:

A timestamp-format change can affect any workflow logic that parses, compares, transforms, or stores that value. Administrators should inspect the new connector output and test mappings and conditions that depend on the timestamp. A connector request may technically succeed while downstream playbook logic fails because it expects the previous format. Physical cabling and display settings do not affect timestamp interpretation. Validating dependent automation is therefore important whenever an external API changes the representation of returned data.

Question 279.

A threat-intelligence lookup returns an unknown classification. What should the playbook do if policy requires additional evidence before containment?

1. Automatically classify the indicator as malicious.
   2. Automatically classify the indicator as benign.
   3. Continue with additional enrichment or analyst review before containment.
   4. Delete the indicator.

Correct Answer: 3

Explanation:

An unknown result represents uncertainty rather than evidence that the indicator is either malicious or benign. If policy requires additional evidence, the workflow should collect more context or route the case to an analyst before performing containment. This reduces the risk of false-positive actions and makes the decision process consistent with organizational requirements. Automatically forcing a classification can produce an unsupported conclusion, while deleting the indicator removes potentially useful investigative data. Uncertainty should be handled explicitly in automation.

Question 280.

What is the best practice after changing a production playbook’s trigger conditions?

1. Assume the new trigger will affect only intended records.
   2. Disable all related connectors.
   3. Delete previous execution history.
   4. Test the trigger criteria and monitor which records initiate the workflow.

Correct Answer: 4

Explanation:

Trigger changes can significantly alter when and how often a production playbook executes. Administrators should test the updated criteria using representative records and verify that the workflow starts only under intended conditions. After deployment, monitoring executions can identify over-triggering, missed records, or unexpected interactions with existing automation. Disabling connectors or deleting execution history does not validate trigger behavior. Careful testing and monitoring reduce the risk of unintended automated actions after trigger logic is modified.