What is the purpose of assigning an incident to a queue?

To automatically close the incident

To ensure the incident is routed to the appropriate team or individual

To delete the incident from the system

To change the incident's severity level

A SOC handles incidents that require immediate response during business hours, but after-hours incidents can wait until the next morning. The manager wants to ensure that incidents arriving during business hours are assigned to on-duty analysts, while after-hours incidents are queued for the next shift. What is the most effective way to achieve this in FortiSOAR?

Create a queue for business hours and another for after-hours, and manually move incidents between them based on the time of arrival.

Create two shifts: one for day and one for night, and assign all analysts to both shifts.

Create a single queue and set a business rule to delay all incidents until the next business day.

Create a shift that covers business hours, assign analysts to it, and configure the queue to route incidents to that shift only during active hours.

At which stage of the incident handling workflow do queues and shifts primarily operate?

During the evidence collection stage

During the initial triage and assignment stage

During the post-incident review stage

In the incident handling workflow, what is the primary purpose of queues and shifts?

To store historical incident data for compliance reporting

To automate the technical investigation of malware samples

To replace the need for human analysts in the incident response process

To manage and distribute incident workload among analysts and teams

Which of the following is a valid criterion for creating a queue in FortiSOAR?

The number of comments on the incident

FortinetNSE 6 - FortiSOAR Analyst

Domain 3Objective 2

Create Queues and Shifts for Workload Management NSE6-FORTISOAR-ANALYST Practice Questions (Page 5)

Part of the Incident Handling domain, which accounts for 5-15% of the NSE6-FORTISOAR-ANALYST exam.

25questions here

5free pages

6concepts

5-15%of the exam

Questions 21–25

21foundation · easy
What is the purpose of assigning an incident to a queue?
Select an answer first
22application · medium
A SOC handles incidents that require immediate response during business hours, but after-hours incidents can wait until the next morning. The manager wants to ensure that incidents arriving during business hours are assigned to on-duty analysts, while after-hours incidents are queued for the next shift. What is the most effective way to achieve this in FortiSOAR?
Select an answer first
23foundation · easy
At which stage of the incident handling workflow do queues and shifts primarily operate?
Select an answer first
24foundation · easy
In the incident handling workflow, what is the primary purpose of queues and shifts?
Select an answer first
25foundation · easy
Which of the following is a valid criterion for creating a queue in FortiSOAR?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to NSE6-FORTISOAR-ANALYST

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Fortinet. “NSE6-FORTISOAR-ANALYST” is a trademark of its owner, used for identification only.