Implement Access Control NSE6-FORTISOAR-ANALYST Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A FortiSOAR administrator is onboarding a new analyst. The analyst will handle incidents for the 'Network' team and needs to create and edit incidents, but should not be able to delete them. The administrator has already created the user account and assigned the 'Network' team. What is the next step to grant the appropriate permissions?

   • AModify the 'Network' team's permissions to allow create and edit, but not delete.
   • BCreate a custom role with create and edit permissions on the Incident module, then assign it to the user.
   • CSet the user's 'Record Ownership' to 'Network' team to grant create and edit permissions.
   • DAssign the 'Analyst' role to the user, which includes create and edit permissions but not delete.
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   How does record ownership affect access control in FortiSOAR?

   • AOnly the owner can view the record, and all other users are denied access
   • BOwners have full control over the record, while others may have limited access based on permissions
   • COwnership has no effect on access control
   • DOwnership only affects the ability to delete records, not to edit them
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A FortiSOAR administrator is configuring roles for a new 'Triage' team. The team members should be able to view and update incidents assigned to them, but they should not be able to view incidents assigned to other teams. The administrator has created a role named 'Triage Analyst' with 'View' and 'Edit' permissions on the Incident module. What else must be configured to ensure that the 'Triage' team members only see incidents assigned to their team?

   • ACreate a separate role for each team and assign the role to the team's users individually.
   • BEnable 'Record Sharing' on the Incident module and share each incident with the 'Triage' team.
   • CSet the Incident module's default permission to 'No Access' for all users except the 'Triage' team.
   • DSet the role's data access to 'Restrict to own records' and assign the role to the 'Triage' team.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A SOC manager wants to organize analysts into functional teams (e.g., Network, Endpoint, Malware) and ensure that each team can only view and manage incidents assigned to their team. The manager has created the teams and assigned users. What additional configuration is required to enforce this data isolation?

   • AEnable 'Record Sharing' on the Incident module and share each incident with the appropriate team.
   • BSet the Incident module's default permission to 'No Access' for all users except the team leads.
   • CAssign a role to each team with 'View' and 'Edit' permissions, and set the role's data access to 'Restrict to own records'.
   • DCreate a separate role for each team and assign the role to the team's users individually.
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   What is the primary purpose of role-based access control (RBAC) in FortiSOAR?

   • ATo assign specific permissions to roles, which are then assigned to users
   • BTo track user login history for auditing
   • CTo encrypt user passwords in the database
   • DTo manage network access to FortiSOAR servers
   Reveal Solution Discussion Select an answer first