Configure Playbooks NSE6-FORTISIEM-ANALYST Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   In FortiSIEM, what defines when a playbook should execute?

   • AThe playbook's action list
   • BThe playbook's name
   • CThe playbook's description
   • DThe playbook's trigger configuration
   Reveal Solution Discussion Select an answer first
2. 17application · easy

   A managed security service provider (MSSP) wants to standardize its incident response for 'brute force' attacks across all its customers. They plan to use a FortiSIEM playbook that, when triggered by a brute-force event, will automatically block the offending source IP for one hour. The playbook has been created and tested. What is the final step to make this playbook operational for all customers?

   • AEnable the playbook in the environment where the customer events are collected.
   • BDisable all other playbooks to prevent conflicts.
   • CModify the trigger to include the customer's name in the event filter.
   • DCreate a separate playbook for each customer to ensure isolation.
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   What is the effect of disabling a playbook in FortiSIEM?

   • AThe playbook will run only during off-peak hours
   • BThe playbook's configuration is deleted
   • CThe playbook will run but without actions
   • DThe playbook will not execute when its trigger conditions are met
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   In FortiSIEM, what is the primary purpose of a playbook?

   • ATo define a set of automated actions that execute in response to specific events or conditions
   • BTo store raw log data for long-term archival and compliance
   • CTo create custom dashboards for visualizing security metrics
   • DTo manage user roles and permissions within the SIEM
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   An analyst has just finished creating a new playbook that automatically disables a user account after three failed login attempts. Before deploying this to production, the analyst wants to ensure the playbook works correctly without affecting real user accounts. What is the most appropriate way to validate this playbook?

   • AReview the playbook configuration visually to confirm the trigger and actions are correct, then enable it.
   • BRun the playbook in a test environment against simulated login failure events and verify the account disable action executes as expected.
   • CCreate a copy of the playbook, enable the copy, and disable the original until the copy is proven to work.
   • DEnable the playbook in production and monitor its execution on real events for a week.
   Reveal Solution Discussion Select an answer first