During a phishing incident, the incident commander asks an analyst to set up a war room so that the response team can collaborate. The analyst needs to ensure the war room is associated with the correct incident and is easily identifiable. What should the analyst do first?

Create a war room with a descriptive name and select the associated incident.

Add all users to the war room and then create it.

Create a new incident and then create a war room for it.

Configure the war room's automation playbooks before creating it.

A war room is being used for a DDoS incident. The team needs to share real-time updates on the attack traffic and coordinate with the ISP. What is the most effective way to use the war room for this?

Use email to communicate with the ISP and post summaries later.

Create a new war room for each update.

Wait until the incident is over to post all updates.

Post frequent updates and use the war room's chat feature for real-time discussion.

A war room has been active for several days. The incident commander notices that a team member who has left the organization still has access. What should the analyst do to ensure security?

Close the war room immediately.

Ignore it because the incident is almost resolved.

Remove the team member from the war room participants list.

Change the war room's name to prevent access.

Which action is typically performed when managing participants in a FortiSOAR war room?

Deleting the associated incident

Changing the incident's severity level

Adding a user who is part of the incident response team

FortinetNSE 6 - FortiSOAR Analyst

Domain 3Objective 3

Use War Rooms for Incident Handling NSE6-FORTISOAR-ANALYST Practice Questions (Page 5)

Part of the Incident Handling domain, which accounts for 5-15% of the NSE6-FORTISOAR-ANALYST exam.

24questions here

5free pages

5concepts

5-15%of the exam

Questions 21–24

21application · medium
During a phishing incident, the incident commander asks an analyst to set up a war room so that the response team can collaborate. The analyst needs to ensure the war room is associated with the correct incident and is easily identifiable. What should the analyst do first?
Select an answer first
22application · medium
A war room is being used for a DDoS incident. The team needs to share real-time updates on the attack traffic and coordinate with the ISP. What is the most effective way to use the war room for this?
Select an answer first
23application · medium
A war room has been active for several days. The incident commander notices that a team member who has left the organization still has access. What should the analyst do to ensure security?
Select an answer first
24foundation · easy
Which action is typically performed when managing participants in a FortiSOAR war room?
Select an answer first

Finished these 4 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to NSE6-FORTISOAR-ANALYST

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Fortinet. “NSE6-FORTISOAR-ANALYST” is a trademark of its owner, used for identification only.