Debug and Troubleshoot Playbooks Using Executed Playbook Logs NSE6-FORTISOAR-ANALYST Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   A playbook that handles incident response is failing intermittently. The executed playbook log shows that the 'Isolate Host' step sometimes fails with a 'Timeout' error, but other times it succeeds. The playbook is triggered by a manual action from the analyst. The FortiSOAR services are all healthy. What is the MOST likely cause of the intermittent timeout?

   • AThe external EDR system is occasionally slow to respond, causing the connector to time out.
   • BThe playbook has a logic error that only occurs under certain conditions.
   • CThe analyst is triggering the playbook too frequently, causing rate limiting.
   • DThe FortiSOAR database is running out of disk space.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A playbook triggered by a new email alert is not appearing in the executed playbook log at all. The email connector is configured and the mailbox has new messages. The FortiSOAR UI is accessible. Which of the following is the MOST likely cause?

   • AThe email polling service or the connector service is not running.
   • BThe email message is a duplicate and was already processed.
   • CThe playbook is disabled in the playbook designer.
   • DThe analyst does not have permission to view the executed playbook log.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A playbook that processes a CSV file from an email attachment is failing. The executed playbook log shows the 'Parse CSV' step succeeded, but the 'Create Records' step failed. You need to see the exact data that was passed from the 'Parse CSV' step to the 'Create Records' step. Where in the executed playbook log would you find this information?

   • AIn the 'Error' section of the 'Create Records' step only.
   • BIn the 'Connector' configuration page, which shows API settings.
   • CIn the 'Output' section of the 'Parse CSV' step and the 'Input' section of the 'Create Records' step.
   • DIn the 'Audit' tab of the playbook, which shows user modifications.
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A playbook that enriches an alert with geolocation data is failing. The executed playbook log shows the 'Geolocate IP' step failed with a '404 Not Found' error. You suspect the connector's API endpoint is incorrect. Where would you verify the configured endpoint URL?

   • AIn the playbook's step configuration.
   • BIn the connector configuration for the geolocation service.
   • CIn the FortiSOAR application log.
   • DIn the executed playbook log's 'Error' section.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A playbook that normally runs on every new incident has not executed for the last hour. The automation is triggered by a connector that polls an external ticketing system. The FortiSOAR UI is responsive, but no new executions appear in the executed playbook log. What should you check FIRST?

   • ALook for a new incident in the ticketing system to confirm the connector has data to fetch.
   • BVerify that the connector service or the FortiSOAR automation service is running and healthy.
   • CReview the playbook's permissions to ensure the analyst's role still has execute rights.
   • DCheck the external ticketing system's API documentation for a change in the polling endpoint.
   Reveal Solution Discussion Select an answer first