An analyst is reviewing an incident timeline to understand the sequence of events. The analyst notices that some alerts occurred before the incident was officially created. How can the analyst best visualize these events in relation to the incident?

Sort the alerts by severity in the list view

Use the timeline view on the incident to see all related alerts in chronological order

Check the audit log of the incident

Manually review each alert's creation time

A security operations center is investigating a coordinated attack that involves multiple alerts, indicators, and affected assets. The incident commander needs to present a clear visual representation of the attack path to executives, and also demonstrate that the response is progressing through the correct phases. Which combination of FortiSOAR features should be used?

Incident details page and audit log

List view of alerts and a custom report of tasks

Timeline view for the sequence of events and a dashboard for metrics

Graph view for the attack path and the incident's phase field with linked tasks

During an incident, the incident commander wants to ensure that all response actions are tracked against the standard incident response phases. In FortiSOAR, what is the most effective way to achieve this?

Add a custom text field to the incident to describe the phase

Create a separate incident for each phase

Use the incident's phase field to update the current phase and link tasks to the incident

Export the incident to a spreadsheet and update it manually

Why is it important for an analyst to map records to incident response phases in FortiSOAR?

To automatically delete records that are no longer relevant

To track progress and ensure comprehensive handling of the incident

To assign the records to external law enforcement agencies

To encrypt all sensitive data within the records

FortinetNSE 6 - FortiSOAR Analyst

Domain 3Objective 4

Correlate Records Across Modules NSE6-FORTISOAR-ANALYST Practice Questions (Page 1)

Part of the Incident Handling domain, which accounts for 5-15% of the NSE6-FORTISOAR-ANALYST exam.

14questions here

3free pages

3concepts

5-15%of the exam

Questions 1–5

1application · medium
An analyst is reviewing an incident timeline to understand the sequence of events. The analyst notices that some alerts occurred before the incident was officially created. How can the analyst best visualize these events in relation to the incident?
Select an answer first
2expert · hard
A security operations center is investigating a coordinated attack that involves multiple alerts, indicators, and affected assets. The incident commander needs to present a clear visual representation of the attack path to executives, and also demonstrate that the response is progressing through the correct phases. Which combination of FortiSOAR features should be used?
Select an answer first
3application · medium
During an incident, the incident commander wants to ensure that all response actions are tracked against the standard incident response phases. In FortiSOAR, what is the most effective way to achieve this?
Select an answer first
4foundation · easy
Why is it important for an analyst to map records to incident response phases in FortiSOAR?
Select an answer first
5foundation · easy
An analyst needs to review the sequence of events related to an incident to understand the timeline of the attack. Which visual tool in FortiSOAR is best suited for this task?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to NSE6-FORTISOAR-ANALYST

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Fortinet. “NSE6-FORTISOAR-ANALYST” is a trademark of its owner, used for identification only.

Correlate Records Across Modules NSE6-FORTISOAR-ANALYST Practice Questions (Page 1)

Questions 1–5

An analyst is reviewing an incident timeline to understand the sequence of events. The analyst notices that some alerts occurred before the incident was officially created. How can the analyst best visualize these events in relation to the incident?

During an incident, the incident commander wants to ensure that all response actions are tracked against the standard incident response phases. In FortiSOAR, what is the most effective way to achieve this?

Why is it important for an analyst to map records to incident response phases in FortiSOAR?

An analyst needs to review the sequence of events related to an incident to understand the timeline of the attack. Which visual tool in FortiSOAR is best suited for this task?

Keep studying — Incident Handling