Debug and Troubleshoot Playbooks Using Executed Playbook Logs NSE6-FORTISOAR-ANALYST Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A playbook fails intermittently when calling an external REST API. The error message in the executed playbook log is generic ('Connection failed'). You need to find more detailed error information from the FortiSOAR backend. Which log file should you examine?

   • AThe database transaction log to check for SQL errors during the playbook run.
   • BThe web server access log (e.g., nginx access log) to see the incoming HTTP requests.
   • CThe audit log to see which user triggered the playbook and when.
   • DThe FortiSOAR application log (e.g., cs.log or fortisoar.log) that records connector and integration errors.
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   A playbook that enriches an alert with threat intelligence is failing. The executed playbook log shows the 'Threat Intel Lookup' step failed with a '401 Unauthorized' error. You verify the API key in the connector configuration and it is correct. You also confirm the external service is up. What is the MOST likely next step to diagnose the issue?

   • ARestart the FortiSOAR services to clear any cached credentials.
   • BRe-enter the API key in the connector configuration and save it again.
   • CCheck the FortiSOAR application log for the full request headers to see if the API key is being sent correctly.
   • DCheck the external service's documentation to see if the API key needs to be rotated.
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A playbook is designed to create a ticket in ServiceNow and then send a Slack notification. The executed playbook log shows the ServiceNow step succeeded, but the Slack step was skipped. The playbook has a conditional path after the ServiceNow step. What is the most likely reason the Slack step was skipped?

   • AThe condition on the path to the Slack step evaluated to false based on the output of the ServiceNow step.
   • BThe Slack connector is not installed or configured in the environment.
   • CThe playbook was manually stopped by an administrator mid-execution.
   • DThe Slack step is not connected to the ServiceNow step in the playbook designer.
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   An analyst needs to review system-level logs to diagnose a problem where playbooks are not triggering at all. Which log file would be most relevant to check for service or scheduling issues?

   • AThe playbook.log, which contains all playbook execution details
   • BThe connector.log, which logs connector API calls
   • CThe audit.log, which tracks user actions and system changes
   • DThe system.log, which records system-level events and service status
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   A playbook is failing, and the executed playbook log shows a '500 Internal Server Error' from a connector. The error message is not detailed enough to determine the root cause. You need to get more detailed logs from the FortiSOAR backend. Which approach would provide the MOST detailed diagnostic information?

   • AReview the audit log to see if a configuration change was made to the connector.
   • BEnable debug logging for the specific connector and reproduce the issue, then check the FortiSOAR application log.
   • CCheck the web server access log for the connector's outbound request.
   • DRestart the FortiSOAR services and re-run the playbook.
   Reveal Solution Discussion Select an answer first