Identify Common Playbook and Connector Issues NSE6-FORTISOAR-ANALYST Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A playbook that creates a ticket in ServiceNow and then updates a custom field fails. The execution log shows the 'Create Ticket' step succeeded, but the 'Update Field' step failed with 'Field not found'. The analyst inspects the input of the 'Update Field' step and sees the 'field_name' is 'custom_field_1'. What should the analyst investigate?

   • ARe-run the playbook to see if the error is intermittent.
   • BCheck the output of the 'Create Ticket' step to see if the ticket ID is correct.
   • CIncrease the playbook's logging level to 'Debug' to capture more details about the update step.
   • DVerify that 'custom_field_1' exists in the ServiceNow table and that the connector's user has write access to it.
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   A FortiSOAR administrator wants to reduce the amount of log data generated by playbooks to only capture critical errors. Which logging level should be selected in the playbook logging configuration?

   • AWARNING
   • BINFO
   • CDEBUG
   • DERROR
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   While troubleshooting a playbook, an analyst needs to see the exact data that was passed into a specific step and what that step returned. Where in FortiSOAR can the analyst view the input and output of an individual step within a playbook execution?

   • AIn the 'Step Details' panel of the executed playbook log
   • BIn the 'System Logs' under 'Diagnostics'
   • CIn the 'Connector Configuration' page
   • DIn the 'Variable Inspector' of the playbook editor
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   An analyst notices that a playbook step is producing unexpected output. What is the most direct way to examine the input that was provided to that step during the last execution?

   • ACheck the connector's documentation
   • BOpen the executed playbook log and expand the step to view its input
   • CRe-run the playbook and watch the step in real time
   • DLook at the playbook's description field
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   A playbook that extracts indicators from an email fails. The execution log shows the 'Parse Email' step succeeded, but the 'Extract Indicators' step failed with 'Invalid input'. The analyst inspects the input of the 'Extract Indicators' step and sees it is a string, but the step expects a list. What is the most likely cause?

   • AThe 'Parse Email' step failed to extract the email body, returning an empty string.
   • BThe playbook's logging level is set to 'Error', which prevents the step from receiving input.
   • CThe 'Extract Indicators' step requires authentication, and the credentials are missing.
   • DThe output of the 'Parse Email' step was not correctly mapped to the input of the 'Extract Indicators' step.
   Reveal Solution Discussion Select an answer first