View Full Fortinet NSE6_FSR-7.3 Exam Dumps and Practice Test Dumps

 

Question 381.

A FortiSOAR workflow receives an alert containing a username but needs the user’s department and account status before deciding how to respond. What should the playbook do?

1. Enrich the alert with information from the appropriate identity or directory integration.
   2. Delete the username from the alert.
   3. Assign the incident randomly.
   4. Create a separate dashboard for the user.

Correct Answer: 1

Explanation:

Enrichment allows the workflow to obtain additional context from an integrated identity or directory service. The returned department and account status can then be mapped into the incident or evaluated by later workflow conditions. This enables response decisions to use relevant organizational context rather than relying only on the original alert. Deleting the username removes a useful lookup value, random assignment ignores available evidence, and a dashboard does not retrieve external identity information. Contextual enrichment supports more informed automated investigation and response.

Question 382.

A connector request returns HTTP 401 after an external service rotates its API token. What should the administrator do?

1. Increase the incident severity.
   2. Update the connector with the valid authentication information and test it.
   3. Change the dashboard layout.
   4. Create a new incident module.

Correct Answer: 2

Explanation:

An HTTP 401 response commonly indicates an authentication problem. If the external service recently rotated its token, FortiSOAR may still be using the old credential. The administrator should update the connector securely and verify authentication and required operations. Depending on the integration, dependent playbooks should also be tested. Changing incident severity, dashboard layout, or module configuration does not correct invalid external credentials. Keeping connector authentication synchronized with external credential changes is essential for reliable automation.

Question 383.

A playbook receives a JSON array containing several devices and needs to find the device whose serial number matches the incident. What should it do?

1. Select the first device regardless of its serial number.
   2. Create a new connector for each device.
   3. Iterate or filter the array and compare the serial-number field.
   4. Delete all returned devices.

Correct Answer: 3

Explanation:

When multiple objects are returned, the workflow should evaluate the relevant field in each object and identify the one that matches the expected serial number. Iteration or filtering provides a structured way to locate the correct device without relying on its position in the array. Selecting the first result could target the wrong system, while creating separate connectors is unnecessary. Understanding arrays and object fields is important when using structured connector responses as input to later FortiSOAR actions.

Question 384.

An automated account-disable workflow cannot determine whether the target is a protected service account. What should it do?

1. Disable the account immediately.
   2. Assume every account is unprotected.
   3. Remove the account information.
   4. Stop or route the action for additional validation before disabling the account.

Correct Answer: 4

Explanation:

Service accounts can support important applications and automated processes, so disabling the wrong account may create significant operational disruption. If the workflow cannot determine whether the target is protected, it should obtain additional context or route the action for human verification. Automatically assuming that the account is safe to disable bypasses an important safeguard. High-impact response workflows should explicitly handle missing critical context and avoid destructive actions until required validation criteria have been satisfied.

Question 385.

Why should FortiSOAR retain the identifier of a ticket created in an external IT service-management system?

1. It allows later workflow actions to reference and update the same external ticket.
   2. It increases server memory.
   3. It replaces external authentication.
   4. It automatically changes incident severity.

Correct Answer: 1

Explanation:

Storing the external ticket identifier creates a reliable reference between the FortiSOAR incident and the corresponding ticket. Later playbook steps can use that identifier to add comments, update status, synchronize information, or verify the external record. It can also help prevent duplicate ticket creation during retries. The identifier does not affect physical memory, replace authentication, or automatically modify severity. Preserving external object identifiers is important for reliable multi-system workflow coordination.

Question 386.

A FortiSOAR connector only needs permission to add comments to external tickets. What privilege model is most appropriate?

1. Full administrator access
   2. The minimum permissions necessary to perform the required comment operation
   3. Permission to delete all tickets
   4. A shared superuser account

Correct Answer: 2

Explanation:

The connector account should receive only the privileges necessary for the operations it performs. If the integration only adds comments, broader administrative or deletion permissions create unnecessary security exposure. Least privilege reduces the potential impact of credential compromise and limits the consequences of incorrectly configured automation. Shared superuser accounts also weaken accountability. Administrators should align service-account permissions with actual connector requirements and review those permissions when workflow functionality changes.

Question 387.

A playbook must process a list of URLs but should skip any URL already marked as trusted. Which workflow design is appropriate?

1. Process every URL without checking trust status.
   2. Delete all trusted URLs.
   3. Iterate through the URLs and conditionally skip trusted entries.
   4. Create one dashboard per URL.

Correct Answer: 3

Explanation:

Iteration combined with conditional logic enables the workflow to process a variable number of URLs while applying trust criteria to each item. Trusted URLs can bypass unnecessary enrichment or containment steps, while other URLs continue through the required analysis. This reduces processing and helps prevent inappropriate response against known-good resources. Deleting trusted data removes useful context, and dashboards do not perform collection processing. Combining loops and conditions provides flexible handling of heterogeneous items within a single collection.

Question 388.

A playbook sends a request to create an external block rule but times out before receiving confirmation. What should it do before retrying?

1. Create several additional block rules.
   2. Mark the incident resolved.
   3. Assume the first request definitely failed.
   4. Check whether the rule already exists and use duplicate-safe retry behavior.

Correct Answer: 4

Explanation:

A timeout indicates uncertainty about the response, not necessarily failure of the external operation. The external platform may have created the rule before communication was interrupted. Repeating the request blindly could create duplicate rules or other unintended effects. When possible, the workflow should query the external state or use a unique identifier to determine whether the original action completed. Idempotent or duplicate-safe retry logic is particularly important for create operations that can persist independently of FortiSOAR’s response state.

Question 389.

Which FortiSOAR capability can provide analysts with a visual summary of open incidents grouped by severity?

1. Dashboard
   2. API token
   3. Connector credential
   4. Approval task

Correct Answer: 1

Explanation:

Dashboards can visually summarize FortiSOAR records according to selected attributes such as severity, status, category, or assignment. A view of open incidents grouped by severity can help analysts quickly understand workload and identify higher-priority cases. API tokens and connector credentials authenticate external integrations, while approval tasks control human authorization within workflows. Dashboards are therefore the appropriate capability when operational data needs to be aggregated and presented visually for rapid review.

Question 390.

An integration can query an endpoint platform but receives an access-denied response when attempting isolation. What should be investigated?

1. Dashboard refresh frequency
   2. The external service account’s authorization for endpoint isolation
   3. Incident title formatting
   4. Server disk capacity

Correct Answer: 2

Explanation:

Successful query operations show that basic connectivity and authentication may already be functioning. Isolation, however, is a higher-privilege action and may require additional authorization. Administrators should review the external account’s assigned privileges and determine whether the required isolation permission is present. Only necessary access should be granted. Dashboard refresh rates, incident titles, and disk capacity do not determine external authorization. Operation-specific permission analysis is therefore appropriate when read actions work but response actions are denied.

Question 391.

A playbook receives a risk score as a string value such as “85” but needs to compare it numerically with a threshold. What should it do?

1. Compare the value only as arbitrary text.
   2. Ignore the score.
   3. Convert or normalize the value to the appropriate numeric type before comparison.
   4. Create a new FortiSOAR server.

Correct Answer: 3

Explanation:

A value represented as text may not behave correctly in a numerical comparison. The workflow should normalize or convert the value into the appropriate numeric representation before applying threshold logic. It should also handle null, malformed, or unexpected values safely. Ignoring the score removes useful evidence, while deploying another server does not solve the data-type issue. Correct type handling ensures that conditions behave predictably when external APIs represent numerical information as strings.

Question 392.

A high-impact playbook requires approval before isolating a critical server. The approver rejects the request. What should happen?

1. Isolation should occur anyway.
   2. The rejection should be deleted.
   3. The connector should receive more privileges.
   4. The playbook should follow the rejection path without performing the isolation.

Correct Answer: 4

Explanation:

The approval step is an explicit control intended to prevent the high-impact action from proceeding without authorization. A rejection should therefore cause the playbook to follow the defined alternative path, which may include further investigation, documentation, or escalation. Performing isolation despite rejection would bypass the control. Increasing connector privileges is unrelated to the decision, and deleting the rejection would reduce accountability. Human approval decisions should be preserved and respected by the workflow.

Question 393.

Why is a controlled test environment useful when developing automated containment workflows?

1. It allows potentially disruptive logic to be validated without unnecessarily affecting production systems.
   2. It guarantees that every production integration will always succeed.
   3. It removes the need for authentication.
   4. It automatically grants administrative access.

Correct Answer: 1

Explanation:

Containment workflows can perform disruptive actions such as endpoint isolation, account disablement, or blocking. Testing them in a controlled environment allows administrators to verify conditions, mappings, connector operations, safeguards, and error handling before production deployment. This reduces the risk that development mistakes will affect live systems. A test environment cannot guarantee permanent production reliability and does not remove authentication or access-control requirements. It is an important component of safer automation change management.

Question 394.

A connector output changes from a single object to an array of objects after an external API update. What should the administrator review?

1. Physical network cabling
   2. Dependent field references, mappings, and collection-processing logic
   3. Dashboard background colors
   4. Analyst monitor sizes

Correct Answer: 2

Explanation:

Changing from an object to an array fundamentally alters how a workflow accesses the returned data. Existing references may expect a direct field and fail when that field is now contained within one or more array entries. Administrators should inspect the new response structure and update mappings, iteration, or selection logic as necessary. Network cabling and display settings do not address data-structure changes. API schema changes should be tested across every dependent workflow that consumes the modified output.

Question 395.

A SOC wants incidents affecting critical assets to be assigned to a specialized response team. What should the playbook use?

1. Random assignment
   2. A single queue for every incident
   3. Asset context combined with conditional assignment logic
   4. Dashboard formatting

Correct Answer: 3

Explanation:

The playbook can use asset information to determine whether an affected system meets the organization’s criticality criteria. Conditional logic can then assign qualifying incidents to the specialized team while routing other incidents according to normal procedures. This supports consistent risk-based case management. Random assignment ignores relevant context, while placing everything in one queue does not implement the requirement. Dashboard formatting only changes presentation. Context-driven assignment allows workflow routing to reflect business and technical importance.

Question 396.

A playbook encounters repeated temporary failures from a threat-intelligence API. What is the most appropriate retry strategy?

1. Retry continuously without delay.
   2. Treat the first failure as a successful lookup.
   3. Delete the incident.
   4. Use bounded retries with appropriate delay or backoff and escalate persistent failures.

Correct Answer: 4

Explanation:

Temporary external failures can justify retrying an operation, but retries should be controlled. Appropriate delays or backoff reduce unnecessary pressure on the service, while a retry limit prevents the workflow from remaining stuck indefinitely. Persistent failure can then be escalated or handled through another defined path. Treating a failed lookup as successful can lead to incorrect response decisions, while deleting the incident loses useful context. Controlled retries provide resilience without creating uncontrolled API traffic.

Question 397.

Which FortiSOAR capability allows data from a threat-intelligence lookup to influence a later firewall action within the same workflow?

1. Playbook orchestration and data passing between steps
   2. Physical disk mirroring
   3. Hardware partitioning
   4. Network cabling

Correct Answer: 1

Explanation:

Playbooks can pass outputs from one step into later actions and use conditions to determine whether those actions should occur. A threat-intelligence result can therefore be evaluated and, when defined criteria are met, used as context or input for an authorized firewall operation. This demonstrates orchestration across integrated products. Physical storage and cabling technologies do not coordinate security actions. Data passing enables separate integrations to participate in a connected and context-aware response process.

Question 398.

A service account password used by a production connector is changed. What should happen next?

1. Delete the associated playbooks.
   2. Update the connector credential and test the operations required by dependent workflows.
   3. Remove all dashboards.
   4. Disable audit information.

Correct Answer: 2

Explanation:

FortiSOAR must use the current service-account credential to authenticate successfully. After updating the connector, administrators should test authentication and the operations that production workflows actually use. This also helps identify whether account permissions changed during the credential update. Deleting playbooks or dashboards is unrelated, while disabling auditing reduces troubleshooting visibility. Credential changes should be followed by targeted validation so integration failures are detected before they interfere with security response processes.

Question 399.

A workflow receives no value for an optional enrichment field. How should it be designed to handle this situation?

1. Treat every missing value as malicious.
   2. Terminate the entire platform.
   3. Validate the field and use a defined fallback, alternate path, or safe default where appropriate.
   4. Delete all related incidents.

Correct Answer: 3

Explanation:

Optional fields may legitimately be absent, so workflows should not assume that every response contains every possible value. Explicit null or empty-value handling allows the playbook to skip an optional action, use a defined fallback, request additional enrichment, or route the case for review. Automatically treating missing information as malicious can cause unsupported decisions. Defensive data handling helps automation remain reliable when external integrations return incomplete but valid responses.

Question 400.

What is the best practice after a new production playbook has completed several successful executions?

1. Remove its validation controls.
   2. Stop reviewing the workflow permanently.
   3. Give every connector administrator privileges.
   4. Continue monitoring failures, outcomes, edge cases, and integration changes over time.

Correct Answer: 4

Explanation:

Several successful executions provide useful evidence, but they do not prove that every future data variation or integration condition will be handled correctly. External APIs, credentials, schemas, threat patterns, and operational requirements can change. Continued monitoring helps identify failures, false positives, unusual edge cases, and opportunities for improvement. Validation controls and least-privilege permissions should remain in place unless a justified change is tested. Ongoing review helps keep production automation dependable as the surrounding environment evolves.