Debug and Troubleshoot Playbooks Using Executed Playbook Logs NSE6-FORTISOAR-ANALYST Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A playbook that enriches an indicator with WHOIS data is failing. The executed playbook log shows the 'WHOIS Lookup' step failed with an error. You need to determine if the failure is due to the connector configuration or the external WHOIS service. What should you examine in the executed playbook log?

   • AThe overall playbook status to see if it is marked as 'Failed'.
   • BThe 'Error' or 'Output' section of the failed step to see the exact error message and HTTP status code.
   • CThe playbook's start time to see if it was triggered during a maintenance window.
   • DThe input variables of the step to confirm the indicator value is correct.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A SOC analyst reports that a playbook triggered by a new phishing alert ran to completion, but the expected containment action (disabling a user account) never happened. The playbook has multiple conditional branches and API calls. The analyst checks the executed playbook log and sees the final step marked 'Success'. Where should the analyst look FIRST to determine why the account was not disabled?

   • ARe-run the playbook manually with the same alert data to see if the issue reproduces.
   • BCheck the FortiSOAR system health dashboard for any service that may have stopped during the playbook run.
   • CReview the input and output variables of each step in the executed playbook log, especially the conditional branch evaluation and the API call response.
   • DLook at the audit trail to see if a different analyst manually disabled the account after the playbook ran.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   Which log file in FortiSOAR is primarily used to troubleshoot issues related to playbook execution and connector activity?

   • A/var/log/fortisoar/playbook.log
   • B/var/log/fortisoar/database.log
   • C/var/log/fortisoar/web.log
   • D/var/log/fortisoar/audit.log
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A playbook that runs on a schedule is not executing. The executed playbook log shows no entries for the scheduled time. You check the FortiSOAR services and find that the 'scheduler' or 'cron' service is stopped. What is the MOST likely impact of this service being stopped?

   • AExisting executed playbook logs will be deleted.
   • BScheduled playbook triggers will not fire, so no new executions will be logged.
   • CManual playbook executions will be blocked.
   • DThe FortiSOAR UI will be inaccessible to all users.
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   Which FortiSOAR user interface element provides a list of all playbook executions, allowing an analyst to open a specific run and inspect its log?

   • AThe 'Dashboard' widget that displays recent playbook runs
   • BThe 'Activity' tab on a record, which shows all actions taken on that record
   • CThe 'Executed Playbooks' list view under the Playbooks module
   • DThe 'Workflow' tab in the Playbook Editor, which shows the execution history of the open playbook
   Reveal Solution Discussion Select an answer first