An analyst in FortiSOAR needs to see which alerts are associated with a specific incident to understand the full scope of the event. What is the primary purpose of creating relationships between these records?

To permanently delete duplicate records from the system

To change the access permissions of the records

To automatically assign the records to a different analyst

To establish context and traceability between related records

A large enterprise is handling a multi-stage attack. The incident commander needs to present the full attack path to management, showing how the initial phishing alert led to lateral movement and data exfiltration. The commander also needs to demonstrate that each response action was performed in the correct phase. In FortiSOAR, what is the most effective approach?

Use the timeline view to show the sequence of alerts and tasks

Create a dashboard with charts of alerts by severity and tasks by status

Use the graph view to show relationships between alerts, indicators, and assets, and ensure tasks are linked to the incident with phase assignments

Export all records to a spreadsheet and create a manual diagram

FortinetNSE 6 - FortiSOAR Analyst

Domain 3Objective 4

Correlate Records Across Modules NSE6-FORTISOAR-ANALYST Practice Questions (Page 2)

Part of the Incident Handling domain, which accounts for 5-15% of the NSE6-FORTISOAR-ANALYST exam.

14questions here

3free pages

3concepts

5-15%of the exam

Questions 6–10

6foundation · easy
In FortiSOAR, an analyst is investigating a security alert and wants to associate it with the related incident and the indicator that triggered it. Which FortiSOAR feature is used to establish these associations between records?
Select an answer first
7foundation · easy
In FortiSOAR, an analyst wants to categorize the current state of an incident as 'Containment' to reflect that the threat has been isolated. What is this categorization called?
Select an answer first
8foundation · easy
An analyst in FortiSOAR needs to see which alerts are associated with a specific incident to understand the full scope of the event. What is the primary purpose of creating relationships between these records?
Select an answer first
9expert · hard
A large enterprise is handling a multi-stage attack. The incident commander needs to present the full attack path to management, showing how the initial phishing alert led to lateral movement and data exfiltration. The commander also needs to demonstrate that each response action was performed in the correct phase. In FortiSOAR, what is the most effective approach?
Select an answer first
10foundation · easy
A FortiSOAR analyst wants to visually explore how multiple indicators are connected to a single incident to spot patterns. Which FortiSOAR feature is designed for this purpose?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to NSE6-FORTISOAR-ANALYST

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Fortinet. “NSE6-FORTISOAR-ANALYST” is a trademark of its owner, used for identification only.

Correlate Records Across Modules NSE6-FORTISOAR-ANALYST Practice Questions (Page 2)

Questions 6–10

In FortiSOAR, an analyst is investigating a security alert and wants to associate it with the related incident and the indicator that triggered it. Which FortiSOAR feature is used to establish these associations between records?

In FortiSOAR, an analyst wants to categorize the current state of an incident as 'Containment' to reflect that the threat has been isolated. What is this categorization called?

An analyst in FortiSOAR needs to see which alerts are associated with a specific incident to understand the full scope of the event. What is the primary purpose of creating relationships between these records?

A FortiSOAR analyst wants to visually explore how multiple indicators are connected to a single incident to spot patterns. Which FortiSOAR feature is designed for this purpose?

Keep studying — Incident Handling