During an incident, the response team is using a war room to share indicators of compromise (IOCs) and coordinate containment. The incident commander wants to ensure that all IOCs are easily accessible for future reference. What should the team do?

Post the IOCs in the war room and use the file attachment feature to store them.

Use the incident's 'Description' field to list all IOCs.

Create a separate incident for each IOC.

Email the IOCs to all team members.

Which of the following is a typical collaboration activity performed in a FortiSOAR war room?

Deleting the war room to start fresh

Changing the incident's status to 'Resolved'

Assigning a new owner to the incident

Sharing relevant files and indicators with the team

In FortiSOAR, which of the following is a basic setting you can configure when creating a war room?

The default language for all messages

The war room's name and description

The list of playbooks to run automatically

A war room has been created for a malware outbreak. The incident commander wants to ensure that only the core response team can post updates, while other stakeholders can view the discussion but not contribute. What should the analyst configure?

Set the war room to 'Read-only' for everyone.

Assign the core team the 'Participant' role and stakeholders the 'Viewer' role.

Remove all stakeholders from the war room.

Use the incident's 'Comments' section for stakeholders.

A security analyst is investigating a suspected ransomware infection. The incident commander wants a dedicated space where the response team can share indicators of compromise, post status updates, and coordinate containment actions without cluttering the main incident record. What should the analyst use in FortiSOAR?

Create a war room and add the response team as participants.

Create a new incident and assign it to the response team.

Use the global search to find relevant past incidents.

Post the details in the system notification feed.

FortinetNSE 6 - FortiSOAR Analyst

Domain 3Objective 3

Use War Rooms for Incident Handling NSE6-FORTISOAR-ANALYST Practice Questions (Page 4)

Part of the Incident Handling domain, which accounts for 5-15% of the NSE6-FORTISOAR-ANALYST exam.

24questions here

5free pages

5concepts

5-15%of the exam

Questions 16–20

16application · medium
During an incident, the response team is using a war room to share indicators of compromise (IOCs) and coordinate containment. The incident commander wants to ensure that all IOCs are easily accessible for future reference. What should the team do?
Select an answer first
17foundation · easy
Which of the following is a typical collaboration activity performed in a FortiSOAR war room?
Select an answer first
18foundation · easy
In FortiSOAR, which of the following is a basic setting you can configure when creating a war room?
Select an answer first
19application · medium
A war room has been created for a malware outbreak. The incident commander wants to ensure that only the core response team can post updates, while other stakeholders can view the discussion but not contribute. What should the analyst configure?
Select an answer first
20application · medium
A security analyst is investigating a suspected ransomware infection. The incident commander wants a dedicated space where the response team can share indicators of compromise, post status updates, and coordinate containment actions without cluttering the main incident record. What should the analyst use in FortiSOAR?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to NSE6-FORTISOAR-ANALYST

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Fortinet. “NSE6-FORTISOAR-ANALYST” is a trademark of its owner, used for identification only.