View Full Fortinet NSE6_FSR-7.3 Exam Dumps and Practice Test Dumps

 

Question 361.

A FortiSOAR workflow receives a new alert from a SIEM and needs to determine whether an incident already exists for the same external alert ID. What should it do first?

1. Search the relevant module for a record containing the external alert ID.
   2. Create a new incident immediately.
   3. Delete the external identifier.
   4. Disable the SIEM connector.

Correct Answer: 1

Explanation:

Searching for the external alert identifier before creating another incident supports deduplication. If an existing record already represents the same alert, the workflow can update that record or associate additional information with it instead of creating another case. This helps reduce duplicate analyst work and keeps case data organized. Creating an incident immediately can produce redundant records, while removing the identifier eliminates useful correlation information. Disabling the connector would prevent legitimate alerts from entering the response process.

Question 362.

A connector returns HTTP 400 when a playbook submits a request to an external API. What should the administrator examine?

1. The number of dashboard widgets
   2. The request parameters, required fields, and data format
   3. The physical disk model
   4. The analyst’s screen resolution

Correct Answer: 2

Explanation:

An HTTP 400 response generally indicates that the external service considers the request invalid. Administrators should inspect the parameters generated by the connector action, confirm that required values are present, and verify that data is formatted as expected by the API. Dynamic playbook inputs should also be checked for null or malformed values. Dashboard widgets and workstation hardware do not determine whether an API request is syntactically or semantically valid. Request-level troubleshooting is therefore the appropriate approach.

Question 363.

A playbook receives several user records from an identity service and must find the record matching a specific email address. What should the workflow do?

1. Select a random user record.
   2. Create a dashboard for every user.
   3. Iterate or filter the returned records using the email value.
   4. Delete all nonmatching users.

Correct Answer: 3

Explanation:

When an integration returns multiple records, the workflow should evaluate the collection and identify the object whose relevant field matches the expected email address. This can be accomplished through appropriate filtering or iterative logic depending on the returned structure and available playbook capabilities. Selecting a random result can target the wrong identity, while deleting external records is unnecessary and potentially harmful. Structured collection processing allows the playbook to reliably identify the correct object for subsequent enrichment or response actions.

Question 364.

A workflow is about to block a domain, but the domain appears on the organization’s trusted-domain list. What should happen?

1. Block it regardless of the trusted status.
   2. Remove it from the trusted list automatically.
   3. Disable all domain enrichment.
   4. Prevent the automatic block and follow the defined exception or review process.

Correct Answer: 4

Explanation:

Trusted-domain lists can act as safeguards against disruptive false-positive response. If a domain is identified as trusted, the workflow should not automatically perform the block unless the organization’s defined process specifically authorizes an exception. It can document the match, gather additional evidence, or request analyst review. Automatically removing the domain from the trusted list would bypass the safeguard. Pre-action validation helps ensure that automated containment does not inadvertently disrupt approved business resources.

Question 365.

What is a primary benefit of assigning incidents to team queues?

1. It organizes responsibility and helps distribute work among appropriate responders.
   2. It increases external API limits.
   3. It eliminates connector authentication.
   4. It expands physical server memory.

Correct Answer: 1

Explanation:

Team queues provide a structured mechanism for routing incidents to groups responsible for particular types of security work. They can help distribute workload, clarify ownership, and ensure cases are visible to the appropriate responders. Assignment logic can also use incident category, severity, business unit, or other context to select the correct queue. Team assignment does not change API limits, authentication requirements, or server hardware. Its purpose is to support organized case management and operational accountability.

Question 366.

A FortiSOAR service account requires permission to create external tickets but not to delete them. Which configuration is most appropriate?

1. Full administrator privileges
   2. Grant only the permissions needed to create and manage the required ticket operations.
   3. Anonymous API access
   4. Unrestricted shared credentials

Correct Answer: 2

Explanation:

Least privilege requires service accounts to receive only the permissions necessary for their intended functions. If the FortiSOAR integration creates or updates tickets but does not delete them, deletion privileges should generally not be granted. This limits the potential impact of credential compromise or incorrect automation. Anonymous or shared unrestricted access weakens security and accountability. Matching external account permissions to the specific connector operations used by production playbooks provides required functionality while minimizing unnecessary exposure.

Question 367.

A playbook must run different enrichment operations for file hashes, URLs, domains, and IP addresses. Which design should be used?

1. A single action that ignores indicator type
   2. Separate FortiSOAR installations for every indicator type
   3. Conditional branching according to indicator type
   4. Dashboard filters only

Correct Answer: 3

Explanation:

Different indicator types frequently require different connector operations or input formats. Conditional branching allows the workflow to inspect the indicator type and route execution to the appropriate enrichment path. This makes the workflow flexible while reducing invalid requests. A generic operation that ignores type may send unsupported values to integrations, while separate FortiSOAR installations are unnecessary. Dashboard filters affect presentation or record selection but do not replace workflow branching. Type-aware conditions support reliable observable processing.

Question 368.

A connector action returns a timeout while creating an external case. Why should the playbook check the external system before immediately retrying?

1. To change the dashboard theme
   2. To increase local disk capacity
   3. To remove execution records
   4. The external case may have been created even though the response was not received.

Correct Answer: 4

Explanation:

A timeout indicates that FortiSOAR did not receive the expected response within the configured period, but it does not necessarily mean the external service failed to process the request. If the case was created, an immediate retry could produce a duplicate. The workflow should use available identifiers or search capabilities to determine whether the original action completed. This duplicate-safe approach is particularly important for create operations. Controlled retries and idempotency make automation more reliable during uncertain communication failures.

Question 369.

Which FortiSOAR capability is appropriate for providing management with a recurring summary of incident statistics?

1. Scheduled reporting
   2. Connector credential rotation
   3. API authentication
   4. Physical network switching

Correct Answer: 1

Explanation:

Scheduled reporting is appropriate when stakeholders require incident information on a recurring basis. Reports can summarize relevant operational measurements such as incident counts, severity distribution, status, or other configured information. This supports regular review without requiring users to manually compile the same information each reporting period. Credential rotation and API authentication secure integrations, while physical switching concerns network infrastructure. Reporting capabilities provide a structured mechanism for communicating recurring SOC information to appropriate stakeholders.

Question 370.

An external integration works for read operations but returns a permission error for record updates. What should the administrator verify?

1. The dashboard background
   2. The external account’s authorization to modify the records
   3. The physical server rack position
   4. The number of analyst monitors

Correct Answer: 2

Explanation:

Successful read operations demonstrate that basic connectivity and authentication may already be working. If modifications fail with a permission-related response, the account may lack the required write privilege. Administrators should review authorization for the specific update operation and grant only the necessary permission when appropriate. Dashboard appearance and physical hardware do not control API authorization. Evaluating operation-specific privileges helps troubleshoot the problem while maintaining the principle of least privilege.

Question 371.

A connector response may contain either a populated value or null for an asset owner field. What should the playbook do before using the field for assignment?

1. Always assume the owner exists.
   2. Replace every owner with the same user.
   3. Validate that the field contains a usable value and define a fallback for missing data.
   4. Delete the asset record when the field is null.

Correct Answer: 3

Explanation:

The workflow should verify that the asset owner field contains a valid value before using it to assign an incident or task. If the value is missing, a defined fallback can route the record to a default team, request additional enrichment, or trigger analyst review. Assuming the value always exists can cause workflow errors or incorrect assignments. Deleting the asset would discard useful information. Explicit null handling makes automation more resilient to incomplete but otherwise valid external data.

Question 372.

A malware-response playbook requires analyst approval before deleting a suspicious file from a critical server. What should happen if the analyst rejects the request?

1. Delete the file anyway.
   2. Remove the approval record.
   3. Increase connector permissions.
   4. Follow the rejection path and do not perform the unauthorized deletion.

Correct Answer: 4

Explanation:

An approval step is intended to control whether a sensitive action can proceed. If the analyst rejects the request, the workflow should honor that decision and follow the defined rejection path. This may include documenting the reason, performing further analysis, or using an alternative response. Deleting the file despite rejection would bypass the control and could disrupt a critical server. Preserving the approval outcome also provides useful accountability for subsequent review and auditing.

Question 373.

Why should administrators maintain separate production and testing versions or configurations when developing high-impact playbooks?

1. To reduce the chance that testing causes unintended actions against production systems.
   2. To guarantee that connectors never fail.
   3. To eliminate the need for authentication.
   4. To make all users administrators.

Correct Answer: 1

Explanation:

Testing high-impact workflows directly against production systems can cause unintended containment, deletion, account changes, or other disruptive actions. A controlled test environment or configuration allows administrators to validate logic using appropriate endpoints, credentials, and data before deployment. Separation does not guarantee that connectors will never fail and does not remove authentication or access-control requirements. It supports safer change management by reducing the operational risk associated with developing and validating security automation.

Question 374.

A playbook’s condition stops working after an external service changes a numeric risk score to a text value. What should be reviewed?

1. Physical network cabling
   2. Data type handling and any required conversion before the comparison
   3. Dashboard color selection
   4. Server rack height

Correct Answer: 2

Explanation:

Conditions can behave incorrectly when the data type changes. A numerical comparison may no longer work as expected if the external API now returns the score as text. Administrators should inspect the actual output and apply appropriate type conversion or normalization before evaluating the threshold. Physical cabling and display settings do not affect logical comparisons. Correct data type handling is essential when workflows depend on external values that may change representation across API versions or product updates.

Question 375.

A SOC wants incidents involving executive accounts to follow a specialized escalation process. Which workflow design is appropriate?

1. Ignore user context.
   2. Send every incident through the executive process.
   3. Enrich user context and use conditional routing for qualifying accounts.
   4. Disable identity integrations.

Correct Answer: 3

Explanation:

Identity enrichment can provide the context needed to determine whether the affected user belongs to a specially handled group. Conditional logic can then route only qualifying incidents through the appropriate escalation path. This avoids applying the specialized process to unrelated cases while ensuring the relevant incidents receive required handling. Ignoring user context prevents the distinction, while sending every incident through the same escalation process is inefficient. Context-aware routing enables consistent application of organization-specific response requirements.

Question 376.

A playbook uses an external API that becomes unavailable for several minutes. Which retry design is most appropriate?

1. Retry continuously with no delay or limit.
   2. Treat the first failure as successful.
   3. Delete the affected incident.
   4. Use controlled retries with suitable delays and an escalation path if failures continue.

Correct Answer: 4

Explanation:

Temporary service outages can often be handled with controlled retries, but repeated immediate requests can add load and provide little benefit while the service remains unavailable. The workflow should use an appropriate delay or backoff strategy, limit retries, and escalate or create a manual task when recovery does not occur. Treating failures as success creates inaccurate status, while deleting incidents removes valuable context. Bounded retry behavior improves resilience without allowing external service problems to create uncontrolled workflow activity.

Question 377.

Which FortiSOAR capability allows one workflow to query a SIEM, enrich an IP address, update a firewall, and create a service ticket?

1. Orchestration
   2. Physical disk mirroring
   3. Hardware partitioning
   4. Network cabling

Correct Answer: 1

Explanation:

Orchestration coordinates actions across multiple integrated technologies as part of one response process. A playbook can consume information from a SIEM, use a threat-intelligence integration for enrichment, invoke an authorized firewall operation, and synchronize the result with a ticketing system. This reduces manual tool switching and helps standardize incident handling. Disk mirroring, partitioning, and cabling are infrastructure concepts rather than cross-product security workflow capabilities. Orchestration enables integrated systems to participate in a unified response.

Question 378.

A connector begins failing immediately after its service account password is changed on the external system. What should the administrator do?

1. Delete the connector permanently.
   2. Update the stored connector credential and validate the required operations.
   3. Remove all incident records.
   4. Disable auditing.

Correct Answer: 2

Explanation:

When an external service-account password changes, FortiSOAR must be configured with the corresponding new credential. Administrators should update the connector securely, test authentication, and validate important operations used by production workflows. Testing only login may be insufficient if the account’s permissions also changed. Deleting the connector or incident records does not solve a credential mismatch, while disabling auditing reduces visibility. Credential synchronization and post-change validation restore reliable integration behavior.

Question 379.

A workflow receives two threat-intelligence results with different confidence levels. What should it do when policy defines a minimum confidence requirement for blocking?

1. Always use the first result.
   2. Block regardless of confidence.
   3. Evaluate the results according to the defined confidence and conflict-handling rules.
   4. Delete both results.

Correct Answer: 3

Explanation:

Threat-intelligence sources can differ in confidence, freshness, or assessment. If organizational policy defines a minimum confidence requirement, the workflow should evaluate the evidence according to that rule rather than choosing arbitrarily. Conflicting or insufficient results can trigger additional enrichment or analyst review. Automatically blocking without meeting the evidence threshold increases false-positive risk, while deleting results removes useful investigative context. Explicit confidence and conflict-handling logic makes automated response decisions more consistent and defensible.

Question 380.

After deploying a new synchronization workflow between FortiSOAR and a ticketing system, what should be monitored closely?

1. Only the dashboard background
   2. Only the number of FortiSOAR users
   3. Only the ticketing product logo
   4. Synchronization failures, duplicate updates, field mappings, conflicts, and overall execution outcomes.

Correct Answer: 4

Explanation:

Synchronization introduces dependencies between two systems and can expose problems involving field mappings, duplicate actions, conflicting updates, authentication, and external API behavior. Monitoring early production executions helps administrators confirm that data moves in the intended direction and that retry logic does not create duplicates. Conflict-resolution rules should also behave predictably when both systems change the same information. Reviewing the full synchronization outcome provides far more useful assurance than monitoring cosmetic or unrelated platform characteristics.