Interact with FortiSOAR Using the API or Custom Triggers NSE6-FORTISOAR-ANALYST Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   An analyst needs to update only the 'status' field of an alert record from 'New' to 'In Progress' without changing other fields. Which HTTP method is most appropriate for this partial update?

   • APATCH
   • BPUT
   • CDELETE
   • DPOST
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   Which HTTP method should be used to update an existing incident record with a specific ID in FortiSOAR?

   • APOST
   • BDELETE
   • CGET
   • DPUT
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   An analyst is writing a script to synchronize incidents between two FortiSOAR instances. The script needs to retrieve incidents from the source instance and create or update them in the destination instance. The analyst wants to avoid duplicating incidents that already exist in the destination. What is the most efficient approach?

   • AUse a unique external ID field to check for existence before creating or updating.
   • BUse the PUT method for all incidents, assuming it will create if not exists.
   • CAlways create new incidents in the destination and delete the old ones.
   • DRetrieve all incidents from the destination and compare them with the source in the script.
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   An analyst is writing a script to interact with FortiSOAR and needs to authenticate. The analyst has the username and password but wants to avoid storing credentials in the script. What is the recommended authentication method for API access?

   • AUse basic authentication with the username and password in the Authorization header.
   • BUse session cookies obtained from a login endpoint.
   • CInclude the password in the query string of each request.
   • DGenerate an API token in FortiSOAR and use it in the Authorization header.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A team wants to allow an external threat intelligence platform to push indicators into FortiSOAR automatically. They plan to use a custom trigger. What is the primary advantage of using a custom trigger over directly using the REST API for this integration?

   • ACustom triggers do not require any configuration in FortiSOAR.
   • BCustom triggers provide a simpler webhook URL that does not require authentication.
   • CCustom triggers can pre-process the incoming data and run a playbook automatically.
   • DCustom triggers are faster than the REST API.
   Reveal Solution Discussion Select an answer first