Configure Playbooks NSE6-FORTISIEM-ANALYST Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   An analyst has created a playbook that is triggered by 'failed login' events and performs several actions, including sending an email and creating a ticket. Before enabling it in production, the analyst wants to verify that the actions execute in the correct order and that the email content is correct. What is the most efficient way to test this?

   • AUse the playbook testing feature to execute it with a sample event and review the execution log.
   • BEnable the playbook and wait for a real failed login event to occur.
   • CManually execute each action in the playbook to verify they work.
   • DReview the playbook configuration in the UI to ensure it looks correct.
   Reveal Solution Discussion Select an answer first
2. 12application · easy

   A playbook that automatically quarantines files on 'ransomware detected' events has been causing false positives. The analyst needs to temporarily stop the playbook from running while the trigger conditions are refined. What is the most appropriate action?

   • ARemove all actions from the playbook.
   • BChange the trigger to a non-existent event type.
   • CDisable the playbook.
   • DDelete the playbook and recreate it later.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   When creating a new playbook in FortiSIEM, which fields must be specified?

   • AExecution schedule and timeout
   • BTrigger condition and action list
   • CNotification recipients and script path
   • DName and description
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   Which statement best describes the role of a playbook in FortiSIEM incident response?

   • AIt provides a structured, repeatable way to respond to incidents by executing predefined steps
   • BIt is used only for generating compliance reports after an incident
   • CIt replaces the need for security analysts by making all decisions automatically
   • DIt is a manual checklist that analysts must follow step by step
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   Which of the following is a valid type of action that can be added to a FortiSIEM playbook?

   • AChange the playbook's name
   • BDelete the playbook
   • CModify the trigger condition
   • DSend an email notification
   Reveal Solution Discussion Select an answer first