Analyze Basic JSON Query and YAQL Statements NSE6-FORTISOAR-ANALYST Practice Questions (Page 2)

Questions 6–8

1. 6application · medium

   A playbook has a list of alert objects with 'type' and 'count' fields. The analyst needs to calculate the TOTAL count of all alerts where type equals 'Malware'. Which YAQL expression should be used?

   • A$.alerts.where($.count).sum($.type = 'Malware')
   • B$.alerts.select($.type = 'Malware').sum($.count)
   • C$.alerts.where($.type = 'Malware').sum($.count)
   • D$.alerts.sum($.count).where($.type = 'Malware')
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   Which YAQL statement transforms a list of incident objects to a list of their 'id' values?

   • A$.incidents.map($.id)
   • B$.incidents.id
   • C$.incidents.select($.id)
   • D$.incidents.where($.id)
   Reveal Solution Discussion Select an answer first
3. 8expert · hard

   A playbook receives a webhook payload that may contain either a single object or an array of objects under the 'data' key. The analyst needs to extract the 'id' field from the first object regardless of the structure. The playbook must handle both cases without failing. Which approach is most robust?

   • AUse YAQL with a conditional check: $.data is array ? $.data[0].id : $.data.id
   • BUse JSON path: {{vars.input.data[0].id}}
   • CUse YAQL: $.data[0].id
   • DUse JSON path: {{vars.input.data.id}}
   Reveal Solution Discussion Select an answer first