Use the Jinja Editor to Troubleshoot Jinja Expressions NSE6-FORTISOAR-ANALYST Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A playbook needs to check if an alert's severity is 'High' OR if the source IP is in a blocklist. The analyst writes: `{% if alert.severity == 'High' or source_ip in blocklist %}`. The Jinja editor reports a syntax error. What is the most likely cause?

   • AThe `source_ip` variable is undefined, causing a runtime error that the editor reports as a syntax error.
   • BThe expression is missing a closing `%}` tag or has an unclosed `{% if %}` block.
   • CThe `in` operator is not valid in Jinja; the analyst should use `blocklist.contains(source_ip)` instead.
   • DThe `or` keyword must be replaced with `||` in Jinja expressions.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A SOC analyst is building a Jinja expression to extract the destination IP from an alert's `dest_ip` field. The expression `{{ alert.dest_ip }}` returns an empty string in the Jinja editor, even though the field is populated in the alert record. Which action should the analyst take first to troubleshoot this issue?

   • AWrap the expression in a `default()` filter: `{{ alert.dest_ip | default('N/A') }}` to force a fallback value.
   • BUse the `|to_json` filter to serialize the entire alert object and confirm the field exists.
   • CChange the expression to `{{ alert['dest_ip'] }}` because dot notation is not supported in FortiSOAR Jinja.
   • DCheck whether the field name is actually `dest_ip` or a nested path like `alert.dest.ip` by inspecting the alert's raw JSON in the editor.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   You enter `{{ alert.owner.name }}` in the Jinja editor and receive an error stating that `name` is undefined. What is the most likely cause?

   • AThe variable `alert` is undefined.
   • BThe `owner` attribute is a string, not an object.
   • CThe `alert.owner` object does not have a `name` attribute.
   • DThe expression uses incorrect delimiters.
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A Jinja expression `{{ alert.ip_address | ipv4('mask') }}` is intended to return the subnet mask of an IP address. The editor returns an error: 'no filter named ipv4'. What is the most likely cause?

   • AThe expression is missing a `|string` filter before `ipv4`.
   • BThe `alert.ip_address` field is not a string, so the filter cannot process it.
   • CThe filter name is case-sensitive; it should be `IPv4` instead of `ipv4`.
   • DThe `ipv4` filter is not a built-in Jinja filter and must be provided by a FortiSOAR custom filter or extension.
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   In the FortiSOAR Jinja editor, after entering `{{ alert.severity | upper }}`, the output shows `HIGH`. What does this output indicate?

   • AThe `upper` filter failed and the original value was returned.
   • BThe expression is a Jinja statement, not an expression, and the output is a side effect.
   • CThe variable `alert.severity` is undefined and the editor returned a default value.
   • DThe expression was evaluated successfully and the `upper` filter was applied.
   Reveal Solution Discussion Select an answer first