Configure Playbooks NSE6-FORTISIEM-ANALYST Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   An organization has a playbook that responds to 'data exfiltration' events. The current flow is: 1) Block the user's network access, 2) Send an email to the security team, 3) Create a ticket. The security team has found that blocking network access before verifying the event is too aggressive and causes business disruption. They want to change the flow so that a ticket is created first, then the security team manually reviews and decides whether to block access. The email should be sent only after the block action is manually approved and executed. How should the analyst modify the playbook?

   • AKeep the current order but change the email action to run only after the block action is manually triggered.
   • BCreate a new playbook for the manual review process and keep the existing playbook for automatic blocking.
   • CReorder the actions to: 1) Create a ticket, 2) Add a manual approval step, 3) Block network access, 4) Send email.
   • DRemove the block action and only create a ticket and send an email.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A playbook is triggered by a 'malware detected' event. The first action is to enrich the event with threat intelligence data. The next action should only run if the enrichment result indicates the file is malicious. The analyst has added the enrichment action and is now adding the next action. What should the analyst configure to ensure the next action only runs under the specified condition?

   • ASet the next action's trigger to be the same as the playbook's trigger.
   • BAdd the next action after the enrichment action in the flow, and it will automatically wait for the enrichment to complete.
   • CConfigure the next action to run in parallel with the enrichment action.
   • DAdd a conditional action that checks the enrichment result and then add the next action inside the 'true' branch.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   What is the purpose of an action in a FortiSIEM playbook?

   • ATo perform a specific task, such as sending a notification or running a script
   • BTo name the playbook
   • CTo define the conditions that start the playbook
   • DTo store log data for analysis
   Reveal Solution Discussion Select an answer first
5. 9application · easy

   A junior analyst is learning about FortiSIEM playbooks and asks a senior analyst: 'What is the primary purpose of a playbook in our incident response process?' The senior analyst should respond that a playbook is used to:

   • AAutomate a sequence of response actions that are triggered by specific events.
   • BGenerate weekly reports on security metrics.
   • CStore historical incident data for compliance reporting.
   • DDefine the network topology and device inventory.
   Reveal Solution Discussion Select an answer first
6. 10application · easy

   An analyst is creating a new playbook to handle 'user lockout' events. The analyst wants to ensure the playbook is easily identifiable in the list of playbooks and that it is not active until fully configured. What should the analyst do during the creation process?

   • AProvide a descriptive name and description, and leave the playbook disabled until configuration is complete.
   • BLeave the name and description blank and enable the playbook after adding the first action.
   • CProvide a name and enable the playbook immediately to test it as it is built.
   • DProvide a name and description, and enable the playbook only after adding all actions.
   Reveal Solution Discussion Select an answer first