View Full Fortinet NSE6_FSR-7.3 Exam Dumps and Practice Test Dumps

 

Question 201.

A FortiSOAR administrator needs to create a new incident automatically from information received by a workflow. Which operation is required?

1. Create a record in the appropriate module
   2. Refresh a dashboard widget
   3. Rotate a connector credential
   4. Export a report

Correct Answer: 1

Explanation:

Creating an incident requires the workflow to create a new record in the appropriate FortiSOAR module and populate the necessary fields with available data. The workflow can then use the resulting record identifier for additional updates, relationships, assignments, or other processing. Dashboard refreshes only change the displayed information, credential rotation concerns integration authentication, and report export produces reporting output. Record creation is therefore the appropriate operation when automation needs to introduce a new incident into the FortiSOAR data model.

Question 202.

A playbook should execute every night to synchronize information with another system. Which execution method is most appropriate?

1. Manual analyst execution only
   2. Scheduled playbook execution
   3. Dashboard filtering
   4. Incident assignment

Correct Answer: 2

Explanation:

Scheduled execution allows a playbook to run according to a defined recurring time requirement without depending on a security record event or manual analyst action. This is appropriate for periodic synchronization, recurring data collection, or other maintenance-oriented workflows. The playbook should include suitable error handling in case the external system is unavailable. Dashboard filtering affects what users see, while incident assignment establishes ownership. A recurring synchronization process is therefore best implemented using an appropriate schedule.

Question 203.

A playbook needs to retrieve records whose status is Open and whose severity is High. Which capability should be used?

1. Connector credential management
   2. Dashboard color formatting
   3. Search or filtering criteria
   4. Physical network routing

Correct Answer: 3

Explanation:

Search and filtering criteria allow FortiSOAR to identify records that match specific field values. Combining status and severity conditions enables the workflow to retrieve only the incidents relevant to the required operation. This reduces unnecessary processing and helps prevent actions against unrelated records. Connector credential management addresses authentication, while dashboard colors concern visualization and network routing provides connectivity. Record filtering is therefore the appropriate capability when automation must select data according to multiple structured attributes.

Question 204.

An automated remediation step fails after several earlier steps succeed. What should a resilient workflow do?

1. Automatically mark the incident resolved.
   2. Delete all previous execution information.
   3. Hide the remediation failure.
   4. Handle the failure through an appropriate exception path.

Correct Answer: 4

Explanation:

A resilient workflow should explicitly account for failures in important actions. If remediation fails, the playbook can record the error, retry when safe, create a task, notify an analyst, or escalate the incident according to organizational procedures. Successful earlier steps do not mean the remediation itself succeeded. Automatically resolving the incident or hiding the failure can create inaccurate operational status. An exception path preserves visibility and ensures that incomplete response actions receive the additional attention they require.

Question 205.

Why is maintaining relationships between incidents and indicators useful?

1. It preserves investigative context between associated records.
   2. It increases server CPU speed.
   3. It eliminates connector authentication.
   4. It automatically closes incidents.

Correct Answer: 1

Explanation:

Relationships help preserve the context connecting indicators with the incidents in which they were observed. Analysts can navigate those associations during investigations, and playbooks can use related records when performing enrichment or response. This structured context can also reveal repeated indicators across different cases. Record relationships do not change hardware performance, eliminate authentication, or automatically determine incident closure. Their purpose is to represent meaningful connections among security objects so that investigations and automation can use those associations effectively.

Question 206.

Which approach is most appropriate for a connector account that only needs to read threat-intelligence data?

1. Grant full administrator privileges.
   2. Grant only the minimum permissions required for the read operations.
   3. Provide unrestricted deletion rights.
   4. Use anonymous administrative access.

Correct Answer: 2

Explanation:

A read-only integration should receive only the permissions necessary to perform the required queries. This follows the principle of least privilege and reduces the potential impact of credential compromise or unintended workflow behavior. Administrative or deletion capabilities would provide unnecessary access that the connector does not need. Anonymous administration also reduces accountability. Matching connector privileges to actual operational requirements provides the needed functionality while minimizing the security exposure associated with service accounts used for automation.

Question 207.

A workflow receives an array of IP addresses from a connector response. What should be used to enrich every IP address?

1. A separate FortiSOAR installation for each address
   2. A new user for every address
   3. Iterative processing of the array
   4. A different dashboard for each address

Correct Answer: 3

Explanation:

Iterative processing allows a workflow to handle every item in an array using the same enrichment logic. The playbook can loop through the returned IP addresses, invoke the required reputation operation, and collect or process each result. This makes the workflow scalable because the number of addresses does not have to be known when the playbook is designed. Creating separate users, dashboards, or installations would add unnecessary complexity. Iteration is therefore the efficient pattern for processing collections of observables.

Question 208.

What should a playbook do if required input data is missing before a destructive response action?

1. Execute the destructive action anyway.
   2. Substitute an arbitrary value.
   3. Suppress the missing-data condition.
   4. Validate the input and stop, branch, or escalate appropriately.

Correct Answer: 4

Explanation:

Destructive actions should not proceed when required input is missing or invalid. The workflow should validate important values before invoking the response operation and follow a defined alternative path when validation fails. Depending on the process, it can stop execution, request analyst input, or escalate the incident. Substituting arbitrary values or suppressing errors could cause an action against the wrong target. Input validation is therefore an important safeguard for high-impact automation and reliable playbook execution.

Question 209.

Which FortiSOAR feature is most appropriate for showing analysts the number of active incidents by severity?

1. Dashboard
   2. API secret
   3. Connector certificate
   4. Manual task

Correct Answer: 1

Explanation:

A dashboard can summarize incident records and present operational information visually. Analysts can use configured widgets or views to understand active incident counts, severity distributions, assignments, status, and other useful metrics. This provides situational awareness without requiring each record to be opened individually. API secrets and certificates authenticate integrations, while manual tasks represent human workflow activities. Dashboards are therefore the appropriate FortiSOAR capability for displaying summarized security information to analysts and managers.

Question 210.

A connector can authenticate successfully but cannot perform a requested response operation. What should be checked?

1. Report font configuration
   2. Authorization permissions assigned to the external account
   3. Dashboard background
   4. Analyst screen resolution

Correct Answer: 2

Explanation:

Successful authentication confirms the account’s identity, but it does not guarantee authorization for every operation. The external account may lack the privilege required to perform the requested response action. Administrators should compare the connector operation with the permissions assigned to the account and grant only what is necessary. Report fonts, dashboard backgrounds, and screen resolution do not affect API authorization. Distinguishing authentication from authorization helps administrators troubleshoot integration failures without making unnecessary configuration changes.

Question 211.

A playbook must choose between endpoint isolation and analyst review according to a confidence score. Which capability should be used?

1. Dashboard scheduling
   2. Report generation
   3. Conditional branching
   4. Physical server replication

Correct Answer: 3

Explanation:

Conditional branching allows the playbook to compare a confidence score with defined criteria and select the appropriate workflow path. A sufficiently strong result might qualify for automated containment, while an uncertain result can be routed for analyst review. Additional safeguards should be used when endpoint isolation could significantly affect operations. Dashboards and reports do not make workflow decisions, while physical replication concerns infrastructure. Conditional logic provides the data-driven decision mechanism required for this type of automated response.

Question 212.

Why should FortiSOAR administrators avoid using one shared privileged account for all administrative users?

1. It increases dashboard size.
   2. It reduces network bandwidth.
   3. It prevents connectors from working.
   4. It weakens individual accountability and auditing.

Correct Answer: 4

Explanation:

Shared privileged accounts make it difficult to determine which individual performed a particular administrative action. Separate user identities provide stronger accountability and allow permissions to be aligned with responsibilities. Audit information becomes more useful when actions can be attributed to specific authorized users. Shared accounts can also complicate credential management and increase exposure. Dashboard size and network bandwidth are unrelated, and connectors do not inherently depend on administrative account sharing. Individual identities therefore provide stronger operational governance.

Question 213.

A SOC wants to use the same domain-enrichment process in several different incident playbooks. Which design is most maintainable?

1. Create reusable workflow logic for the enrichment process.
   2. Manually duplicate every step and never reuse logic.
   3. Disable the domain-intelligence connector.
   4. Create a separate FortiSOAR system for each playbook.

Correct Answer: 1

Explanation:

Reusable workflow logic allows the common domain-enrichment sequence to be maintained as a modular component and invoked from multiple processes. This reduces duplication and can improve consistency because each playbook relies on the same tested logic. Updates can also be easier when the enrichment process changes. Manually duplicating steps increases maintenance effort, while disabling the connector removes the required functionality. Separate FortiSOAR systems are unnecessary. Modular design is therefore preferable for frequently repeated automation sequences.

Question 214.

A third-party service changes the name of a field in its API response. What should the FortiSOAR administrator review?

1. Physical disk capacity
   2. Playbook mappings and references that depend on the changed field
   3. Office network cable colors
   4. Analyst keyboard settings

Correct Answer: 2

Explanation:

Playbooks may reference specific fields in connector output for conditions, record updates, notifications, or later connector actions. If the external API changes a field name, those references may no longer return the expected information. The administrator should inspect the new response, update affected mappings or variables, and test the dependent workflows. Disk capacity and workstation settings do not influence API field names. Integration changes should therefore be evaluated for downstream effects on automation logic and data handling.

Question 215.

Which practice best supports safe automation of high-impact security response actions?

1. Remove all validation to make execution faster.
   2. Grant connectors unrestricted access.
   3. Use appropriate evidence checks, safeguards, and approval controls.
   4. Suppress all failed execution messages.

Correct Answer: 3

Explanation:

High-impact response actions should be protected by controls proportional to their potential operational effect. Relevant safeguards can include enrichment requirements, allowlists, confidence thresholds, target validation, least-privilege connector permissions, and human approval when required. These controls reduce the risk of false-positive or incorrectly targeted actions. Removing validation, granting excessive privileges, or suppressing errors makes automation less safe. Well-designed safeguards allow organizations to gain response speed while maintaining appropriate control over disruptive actions.

Question 216.

A playbook successfully isolates an endpoint but the notification step fails. What should the execution record communicate?

1. That every workflow step succeeded
   2. That endpoint isolation failed
   3. Nothing, because partial failures should be hidden
   4. That isolation succeeded but the notification step failed.

Correct Answer: 4

Explanation:

Execution information should accurately reflect the outcome of each important workflow step. In this scenario, the endpoint containment action succeeded, while the notification did not. Treating the entire workflow as completely successful would hide the communication failure, while treating isolation as failed would misrepresent the actual response state. Accurate step-level information allows analysts to take the appropriate follow-up action, such as manually notifying the relevant team. Transparent partial-failure reporting improves troubleshooting, auditing, and operational decision-making.

Question 217.

Which FortiSOAR concept enables a single workflow to coordinate a SIEM, threat-intelligence service, endpoint platform, and ticketing system?

1. Orchestration
   2. Disk partitioning
   3. Hardware RAID
   4. Physical routing

Correct Answer: 1

Explanation:

Orchestration coordinates multiple integrated technologies within one security process. FortiSOAR can receive or process information associated with a SIEM alert, enrich indicators through threat intelligence, query or act through an endpoint platform, and update an external ticketing system. This reduces manual tool switching and promotes repeatable response procedures. Disk partitioning, RAID, and physical routing are infrastructure concepts rather than security workflow coordination mechanisms. Orchestration is therefore central to multi-product SOAR operations.

Question 218.

What should an administrator review when a scheduled playbook does not execute at the expected time?

1. Dashboard colors only
   2. Schedule configuration, playbook status, and relevant execution information
   3. Monitor model
   4. Physical keyboard layout

Correct Answer: 2

Explanation:

Troubleshooting a scheduled workflow should begin with the settings that control its execution. Administrators should verify the configured schedule, confirm that the playbook is enabled and eligible to run, and review available execution information for errors or missed runs. Related system or integration issues can then be investigated if the workflow starts but fails later. Dashboard colors, monitor models, and keyboard layouts do not control scheduled execution. Focusing on scheduling and execution state provides the most relevant diagnostic information.

Question 219.

A workflow receives conflicting severity values from two data sources. What is the best design approach?

1. Randomly choose one value.
   2. Delete both source records.
   3. Apply a defined precedence or conflict-resolution rule.
   4. Disable all integrations.

Correct Answer: 3

Explanation:

Conflicting data should be handled according to a documented rule rather than arbitrary selection. The workflow might use a trusted-source hierarchy, a defined mapping, additional evidence, or analyst review depending on the organization’s process. Explicit conflict resolution makes automation predictable and easier to audit. Random selection can lead to inconsistent response, while deleting records removes useful evidence. Disabling integrations is unnecessarily disruptive. Defined precedence or escalation logic provides a controlled method for handling contradictory input.

Question 220.

What should be done after modifying a FortiSOAR module field that is referenced by multiple production playbooks?

1. Assume all references remain valid automatically.
   2. Delete every record using the field.
   3. Disable all connectors permanently.
   4. Identify dependent workflows and validate their mappings, conditions, and updates.

Correct Answer: 4

Explanation:

A field change can affect any playbook that reads, evaluates, maps, or updates that field. Administrators should identify dependent workflows and verify that their references still resolve correctly. Testing should cover relevant conditions, connector inputs, record updates, and alternative execution paths. Assuming compatibility can allow failures to reach production unnoticed. Deleting records or disabling integrations does not address the dependency. Dependency-aware validation is therefore important whenever shared data-model elements are modified.