Manage FortiSOAR Incident Phases NSE6-FORTISOAR-ANALYST Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A FortiSOAR incident is in the 'Containment' phase. The analyst has isolated the affected host and blocked the malicious IP. However, the analyst discovers that the containment actions have caused a critical business application to fail, impacting revenue. The business owner is demanding that the host be reconnected immediately. The incident is not fully contained. What should the analyst do?

   • AMove the incident to the 'Recovery' phase to restore the business application.
   • BKeep the host isolated and explain to the business owner that containment is necessary to prevent further spread, while working on an alternative solution.
   • CClose the incident and open a new one for the business application issue.
   • DImmediately reconnect the host to satisfy the business owner and avoid revenue loss.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A FortiSOAR analyst is working on an incident that was initially classified as a 'Phishing' attempt. During the investigation, the analyst discovers that the email contained a malicious attachment that led to a system compromise. The analyst needs to update the incident to reflect the new understanding. Which set of actions should the analyst perform?

   • ACreate a new 'Malware' incident and close the original 'Phishing' incident as a duplicate.
   • BChange the phase to 'Closed' because the root cause has been identified.
   • CLeave the incident type as 'Phishing' but add a note about the malware.
   • DUpdate the incident's type to 'Malware' and change the phase to 'Containment'.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   What is the primary benefit of applying the MITRE ATT&CK framework to incident response in FortiSOAR?

   • AIt ensures compliance with all data protection regulations
   • BIt eliminates the need for threat intelligence feeds
   • CIt provides a common language to describe adversary behavior, improving communication and response consistency
   • DIt guarantees that all incidents are automatically resolved without human intervention
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   An analyst is investigating an incident where a user downloaded a file from a phishing email. The file, when executed, established persistence by creating a scheduled task. The analyst has mapped the initial execution to T1204 (User Execution) and the persistence mechanism to T1053.005 (Scheduled Task). The incident is in the 'Investigation' phase. What is the most critical next step in the investigation?

   • AMove the incident to the 'Closure' phase and write the final report.
   • BUse the mapped techniques to search for other hosts that may have executed the same file or have similar scheduled tasks.
   • CIgnore the T1053.005 mapping and focus only on the initial execution vector.
   • DClose the incident because the initial vector and persistence mechanism have been identified.
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   Which action best describes 'updating phase status' in FortiSOAR?

   • AAssigning a new owner to the incident
   • BAdding a comment to the incident timeline
   • CChanging the phase field to reflect the current stage of the incident
   • DChanging the severity level of the incident
   Reveal Solution Discussion Select an answer first