Analyze How Modules, Records, Fields, and Relationships Define the FortiSOAR Data Model NSE6-FORTISOAR-ANALYST Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A company is migrating from a legacy ticketing system to FortiSOAR. They have a complex data model with 'Incidents', 'Problems', and 'Changes'. In the legacy system, an incident could be linked to multiple problems, and a problem could be linked to multiple changes. The team wants to replicate this in FortiSOAR. How should they model the relationships?

   • AUse a single 'Ticket' module with a type field to distinguish incidents, problems, and changes.
   • BCreate a self-referencing relationship on the 'Incidents' module to link to problems and changes.
   • CCreate junction modules to link 'Incidents' to 'Problems' and 'Problems' to 'Changes'.
   • DAdd a lookup field on 'Incidents' to 'Problems' and a lookup field on 'Problems' to 'Changes'.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   An analyst is investigating a security incident and needs to see how the affected assets, related indicators, and associated cases are connected. The analyst wants a graphical view of these relationships to identify patterns that might not be obvious in a list view. Which FortiSOAR feature should the analyst use?

   • ACreate a custom report that lists all related records.
   • BExport the incident data to a CSV file and analyze it in a spreadsheet.
   • COpen each related record in a separate tab to compare them manually.
   • DUse the Visual Correlation feature on the incident record.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   In FortiSOAR, what is a module?

   • AA logical grouping of fields that represents a data entity
   • BA type of connector
   • CA container for storing playbooks
   • DA dashboard for visualizing data
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A managed security service provider (MSSP) uses FortiSOAR to serve multiple customers. They have a central instance with tenant nodes for each customer. An analyst from Customer A needs to temporarily assist with an incident for Customer B. The MSSP wants to grant the analyst access to Customer B's data without giving them permanent access to all of Customer B's records. What is the most appropriate way to achieve this?

   • AAssign the analyst to Customer B's tenant node permanently.
   • BCreate a new user account for the analyst in Customer B's tenant.
   • CUse record-level permissions to grant the analyst access to only the specific incident.
   • DShare the incident data via a CSV export.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A security operations center has deployed FortiSOAR agents on servers in a remote office. The agents are configured to connect to the central FortiSOAR instance. Recently, the agents have been losing connectivity intermittently. The network team confirms that the firewall allows outbound HTTPS traffic. What is the most likely cause of the connectivity issue?

   • AThe agents are not configured with the correct tenant node ID.
   • BThe solution pack containing the agent configuration is outdated.
   • CThe agents are using an unsupported protocol for communication.
   • DThe central FortiSOAR instance is not reachable due to a DNS resolution failure.
   Reveal Solution Discussion Select an answer first