Use War Rooms for Incident Handling NSE6-FORTISOAR-ANALYST Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   A war room was created for an incident, but the incident commander realizes that a participant from a different department should not have access to the sensitive discussions. The participant has already seen some information. What should the analyst do to mitigate the risk?

   • AChange the war room's name to prevent the participant from finding it.
   • BClose the war room immediately and create a new one.
   • CRemove the participant from the war room and review the activity log for any sensitive information they may have seen.
   • DIgnore the issue since the participant has already seen the information.
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   When creating a war room in FortiSOAR, which of the following is a required configuration step?

   • AUploading a list of all potential threat indicators
   • BDefining a custom color scheme for the war room interface
   • CSetting a specific time zone for the war room
   • DSelecting the incident to which the war room will be associated
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   In a FortiSOAR war room, which feature is used to share real-time updates with all participants?

   • APosting messages to the war room feed
   • BCreating a new incident for each update
   • CSending emails to each participant individually
   • DEditing the incident's description
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   During a long-running incident, the war room has many posts. The incident commander wants to quickly find the latest update on a specific containment action. What should the analyst do?

   • AScroll through all posts to find the update.
   • BUse the war room's search or filter feature to locate the relevant post.
   • CAsk the incident commander to repost the update.
   • DCreate a new war room for the specific action.
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   A war room is being used for a complex incident involving multiple teams. The incident commander wants to ensure that all teams are aware of the latest developments, but some team members are not active in the war room. What should the analyst do to improve collaboration?

   • ACreate a separate war room for each team.
   • BEncourage all team members to post updates and use the war room's notification features to alert them.
   • CRemove inactive team members from the war room.
   • DSend emails to all team members with updates.
   Reveal Solution Discussion Select an answer first