Identify Common Playbook and Connector Issues NSE6-FORTISOAR-ANALYST Practice Questions (Page 3)

Questions 11–14

1. 11application · medium

   A playbook that sends an email notification fails. The execution log shows the 'Send Email' step failed with error 'Connection refused'. The analyst checks the step's input and sees the SMTP server address is 'smtp.example.com' and the port is '25'. What is the most likely cause of this error?

   • AThe email body contains invalid characters that the SMTP server rejects.
   • BThe playbook's logging level is set to 'Error', which prevents the step from executing.
   • CThe SMTP server requires authentication, and the credentials are incorrect.
   • DThe SMTP server is not reachable from the FortiSOAR instance, possibly due to a firewall or network issue.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   After a playbook execution completes, an analyst wants to review the logs to trace the flow of execution and identify where an error occurred. Where in the FortiSOAR interface can the analyst find the logs for a specific playbook execution?

   • AIn the 'Dashboards' module under 'Playbook Analytics'
   • BIn the 'Connectors' module under 'Logs'
   • CIn the 'Audit Trails' module
   • DIn the 'Executed Playbooks' section of the Playbooks module
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A playbook that enriches an alert with user details from Active Directory fails intermittently. The execution log shows the 'Get User Info' step sometimes fails with 'Timeout' and sometimes succeeds. The analyst notices the step's input is the same each time. What is the most likely cause of the intermittent failure?

   • AThe connector's credentials are occasionally invalidated by the Active Directory server.
   • BThe Active Directory server is occasionally slow to respond, causing the connector to time out.
   • CThe 'Get User Info' step's input is sometimes transformed incorrectly by a previous step.
   • DThe playbook's logging level is set to 'Error', which causes the step to fail intermittently.
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A playbook that creates a ticket in Jira and then sends a notification to the analyst fails. The execution log shows the 'Create Ticket' step succeeded, but the 'Send Notification' step failed with 'Invalid recipient'. The analyst checks the input of the 'Send Notification' step and sees the 'recipient' field contains 'analyst@example.com'. What should the analyst investigate next?

   • ACheck the output of the 'Create Ticket' step to see if it contains the ticket ID, which might be needed for the notification.
   • BIncrease the playbook's logging level to 'Debug' to capture more details about the notification step.
   • CVerify that the email address 'analyst@example.com' is valid and that the notification connector can send to it.
   • DRe-run the playbook to see if the error is intermittent.
   Reveal Solution Discussion Select an answer first