Manage FortiSOAR Incident Phases NSE6-FORTISOAR-ANALYST Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   Which sequence correctly represents the standard incident lifecycle stages in FortiSOAR, from creation to closure?

   • ACreate → Remediate → Triage → Investigate → Close
   • BCreate → Triage → Investigate → Remediate → Close
   • CCreate → Investigate → Triage → Remediate → Close
   • DTriage → Create → Investigate → Close → Remediate
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A FortiSOAR analyst is handling an incident that has been moved to the 'Containment' phase. The analyst has successfully isolated the affected host and blocked the malicious IP. However, the analyst notices that the incident phase is still 'Containment' even though the containment actions are complete. What should the analyst do next to properly manage the incident lifecycle?

   • ALeave the incident in the 'Containment' phase and add a note that the actions are complete.
   • BMove the incident to the 'Eradication' phase to begin removing the threat from the environment.
   • CClose the incident because the immediate threat has been contained.
   • DReopen the incident in the 'Triage' phase to re-assess the situation.
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A SOC manager is reviewing the incident handling process in FortiSOAR. The manager notices that many incidents are being closed in the 'Containment' phase without moving to 'Eradication' or 'Recovery'. The manager wants to improve the process to ensure incidents are fully resolved. Which approach should the manager take?

   • AChange the default phase for new incidents to 'Eradication' to skip the earlier phases.
   • BConfigure a playbook that automatically moves incidents from 'Containment' to 'Eradication' after a set period, ensuring the lifecycle progresses.
   • CDelete all incidents that are closed in the 'Containment' phase to clean up the system.
   • DImplement a mandatory checklist in the 'Containment' phase that must be completed before the incident can be moved to 'Closure'.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   Which element of MITRE ATT&CK represents the 'why' of an attack step — the adversary's goal?

   • ATactic
   • BProcedure
   • CMitigation
   • DTechnique
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A SOC analyst is triaging a phishing incident in FortiSOAR. After confirming the email is malicious and containing a credential-harvesting link, the analyst needs to formally move the incident from the 'Triage' phase to the 'Investigation' phase. The analyst's role has permissions to update incident records but not to delete them. Which action should the analyst take in FortiSOAR to accomplish this?

   • ARun a playbook that closes the incident and then manually opens a new one in the 'Investigation' phase.
   • BEdit the incident record and change the 'Phase' field from 'Triage' to 'Investigation'.
   • CDelete the 'Triage' incident and recreate it with the 'Investigation' phase selected.
   • DCreate a new incident of type 'Investigation' and link the original phishing incident to it as a related record.
   Reveal Solution Discussion Select an answer first