Configure Playbooks NSE6-FORTISIEM-ANALYST Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   In FortiSIEM, what is the purpose of conditional logic in a playbook's execution flow?

   • ATo specify the playbook's name and description
   • BTo control which actions run based on certain conditions
   • CTo determine how long the playbook can run
   • DTo define the trigger event for the playbook
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   What is the purpose of the description field when creating a playbook in FortiSIEM?

   • ATo set the priority level of the playbook
   • BTo define the trigger conditions for the playbook
   • CTo document the playbook's purpose and intended use
   • DTo specify the exact script that the playbook will execute
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   Which of the following is an example of a playbook trigger in FortiSIEM?

   • AThe name of the playbook containing the word 'critical'
   • BThe description mentioning 'incident response'
   • CThe number of actions configured in the playbook
   • DA specific event type, such as a failed login, being detected
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   What should an administrator do after making changes to a playbook to ensure it still works correctly?

   • ADisable the playbook permanently
   • BDelete the playbook and recreate it
   • CTest the playbook to validate its behavior
   • DChange the playbook's name to reflect the update
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A security analyst at a financial firm wants to automate the initial response to a high-severity malware detection event. The playbook should fire only when the event originates from a server in the production subnet, and it should immediately notify the on-call engineer via email. The analyst has already created the playbook and added the email notification action. What must the analyst configure next to ensure the playbook behaves as required?

   • AConfigure the email action to filter events by source IP and event type, then enable the playbook.
   • BEnable the playbook, then add a condition action inside the playbook to check the source IP range.
   • CSet the trigger to match events where the source IP is in the production subnet and the event type is malware detection, then enable the playbook.
   • DDisable the playbook, edit the trigger to match the production subnet, and then re-enable it after testing.
   Reveal Solution Discussion Select an answer first