A security operations manager wants to explain to a new analyst how FortiSIEM playbooks fit into the incident response process. The manager should explain that a playbook is:

A set of automated actions that are executed in response to a specific event or condition.

A tool for visualizing the network topology.

A collection of rules that define what constitutes a security incident.

A report that summarizes security events over a period of time.

Why might an administrator disable a playbook in FortiSIEM?

To permanently remove the playbook from the system

To make the playbook run more frequently

To change the playbook's trigger conditions

To temporarily stop the playbook from running while it is being updated

What does 'branching' refer to in a FortiSIEM playbook?

Executing different sets of actions based on conditions

Repeating actions until a condition is met

Running actions in parallel without any conditions

Splitting the playbook into multiple separate playbooks

What is the purpose of testing a playbook in FortiSIEM?

To permanently enable the playbook

To change the playbook's trigger conditions

To verify that the playbook executes as expected before it is used in production

To increase the playbook's execution speed

A SOC team is building a playbook to handle phishing email reports. The playbook should first check if the reported email contains a known malicious attachment hash. If it does, the playbook should quarantine the email and send an alert to the incident response team. If not, it should simply log the report and close the ticket. The analyst has added the 'check hash' action. What is the next step to implement the branching logic?

Create two separate playbooks, one for each possible outcome of the hash check.

Configure the quarantine action to run only if the hash check fails, and the log action to run only if it succeeds.

Place the log and close actions before the hash check so they always run, then add the quarantine action after.

Add a conditional action that evaluates the hash check result and routes to the quarantine/alert branch or the log/close branch.

FortinetNSE 6 - FortiSIEM Analyst

Domain 2Objective 3

Configure Playbooks NSE6-FORTISIEM-ANALYST Practice Questions (Page 1)

Part of the FortiEDR Security Settings and Policies domain, which makes up ~24% of our current practice bank. Fortinet does not publish an official question count, but from its 70-minute exam (~30–45 total, ~7–11 in this domain), expect 2–3 from this objective — we provide 25 practice questions to prepare you well beyond it. (estimate)

25questions here

5free pages

7concepts

Questions 1–5

1application · easy
A security operations manager wants to explain to a new analyst how FortiSIEM playbooks fit into the incident response process. The manager should explain that a playbook is:
Select an answer first
2foundation · easy
Why might an administrator disable a playbook in FortiSIEM?
Select an answer first
3foundation · easy
What does 'branching' refer to in a FortiSIEM playbook?
Select an answer first
4foundation · easy
What is the purpose of testing a playbook in FortiSIEM?
Select an answer first
5application · medium
A SOC team is building a playbook to handle phishing email reports. The playbook should first check if the reported email contains a known malicious attachment hash. If it does, the playbook should quarantine the email and send an alert to the incident response team. If not, it should simply log the report and close the ticket. The analyst has added the 'check hash' action. What is the next step to implement the branching logic?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to NSE6-FORTISIEM-ANALYST

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Fortinet. “NSE6-FORTISIEM-ANALYST” is a trademark of its owner, used for identification only.