Use the Jinja Editor to Troubleshoot Jinja Expressions NSE6-FORTISOAR-ANALYST Practice Questions (Page 3)

Questions 11–14

1. 11application · easy

   An analyst needs to create a Jinja expression that returns the number of items in the `alert.tags` list. Which expression is syntactically correct?

   • A`{{ alert.tags | length }}`
   • B`{{ alert.tags | size }}`
   • C`{{ len(alert.tags) }}`
   • D`{{ alert.tags.count() }}`
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   You run `{{ alert.severity + 1 }}` in the Jinja editor and receive an error. What is the most likely cause?

   • AThe variable `alert.severity` is undefined.
   • BThe expression is missing a closing curly brace.
   • CThe `+` operator is not supported in Jinja expressions.
   • DA type mismatch: `alert.severity` is a string and cannot be added to an integer.
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A playbook processes alerts where `alert.user.email` may be missing. The analyst writes `{{ alert.user.email | default('unknown@example.com') }}`. For one alert, the output is `unknown@example.com` even though the email exists. The analyst inspects the raw JSON and sees `alert.user.email` is an empty string `''`. Why does the `default` filter not return the actual email?

   • AThe `default` filter is case-sensitive and the email is uppercase.
   • BThe `alert.user.email` field is actually `None` in the JSON, not an empty string.
   • CThe `default` filter only replaces `None` values, not empty strings.
   • DThe `default` filter requires a `boolean` parameter to treat empty strings as missing.
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   An analyst is troubleshooting a Jinja expression that formats a timestamp: `{{ alert.timestamp | datetimeformat('%Y-%m-%d %H:%M:%S') }}`. The output is `2025-03-15 10:30:00` but the expected timezone is UTC+2. The alert's `timestamp` field is a string in ISO 8601 format with a `Z` suffix. What is the most likely issue?

   • AThe `datetimeformat` filter does not perform timezone conversion; it only formats the datetime object as-is.
   • BThe `timestamp` field is a string, so the filter cannot parse it; the analyst must first convert it to a datetime object.
   • CThe `%H:%M:%S` format string is incorrect; it should be `%I:%M:%S %p` for 24-hour time.
   • DThe `Z` suffix is not recognized by the filter, so it is ignored, and the time is treated as UTC.
   Reveal Solution Discussion Select an answer first