Identify Common Playbook and Connector Issues NSE6-FORTISOAR-ANALYST Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A playbook that fetches a list of blocked IPs from a firewall runs, but the output is empty. The execution log shows the 'Get Blocked IPs' step succeeded with status 'Success', but the 'result' field is an empty list. The analyst wants to know if the firewall actually returned an empty list or if the response was not parsed correctly. What should the analyst examine?

   • AThe global variables to see if the output was overwritten by another step.
   • BThe input of the 'Get Blocked IPs' step to verify the firewall address is correct.
   • CThe raw response of the 'Get Blocked IPs' step in the execution log to see if the firewall returned data.
   • DThe playbook's logging level to ensure it is set to 'Debug' to capture more details.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A playbook that processes user-reported phishing emails is failing intermittently. The analyst wants to see the exact error message from the failing step. The current logs show the step failed, but the error message is truncated. What should the analyst do to capture the full error message?

   • AEnable 'Detailed Errors' in the playbook's error handling configuration.
   • BRe-run the playbook with the 'Verbose' flag in the execution dialog.
   • CCheck the system's event log for the full error message.
   • DIncrease the playbook's logging level to 'Debug' and re-run the playbook.
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   An analyst needs to increase the verbosity of logs generated during playbook execution to capture more detailed diagnostic information. Where in FortiSOAR is the logging level for playbooks configured?

   • AIn the playbook editor, under the 'Settings' tab of the playbook
   • BIn the 'Global Variables' section of the playbook editor
   • CIn the 'Configuration' section under 'System' settings
   • DIn the 'System Settings' under the 'Logging' section
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   An analyst is reviewing the logs of a failed playbook execution. What information is typically available in the execution log to help identify the cause of the failure?

   • AThe step-by-step execution details, including inputs, outputs, and error messages
   • BThe username of the analyst who triggered the playbook
   • CThe current system time and date
   • DThe list of all playbooks in the system
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   A playbook that enriches an alert with threat intelligence fails. The execution log shows the 'Get Threat Intel' step failed with 'HTTP 500'. The analyst checks the step's input and sees the 'indicator' field contains 'example.com'. What should the analyst do to determine if the issue is with the connector or the threat intelligence provider?

   • ACheck the output of the previous step to see if the 'indicator' was transformed incorrectly.
   • BIncrease the playbook's logging level to 'Debug' to capture more details about the request.
   • CRe-run the playbook to see if the error is intermittent.
   • DCheck the raw response of the 'Get Threat Intel' step to see if the provider returned an error message in the body.
   Reveal Solution Discussion Select an answer first