FCP Security Automation & Orchestration (SOAR) 1 — Questions and Answers
Question 1: What is the primary purpose of SOAR (Security Orchestration, Automation and Response) in a security operations center?
- To replace human analysts entirely with AI-driven decisions
- To automate repetitive security tasks and orchestrate tools for faster incident response (Correct answer)
- To store and archive all security logs in a central repository
- To scan networks for open ports and vulnerabilities
Correct answer: To automate repetitive security tasks and orchestrate tools for faster incident response
SOAR platforms automate repetitive tasks such as alert triage and coordinate multiple security tools to accelerate incident response and reduce analyst workload.
Question 2: Which Fortinet product is the dedicated SOAR solution for automating security workflows and managing incidents?
- FortiSIEM
- FortiAnalyzer
- FortiSOAR (Correct answer)
- FortiManager
Correct answer: FortiSOAR
FortiSOAR is Fortinet's purpose-built SOAR platform that provides playbook automation, case management, and integrations for orchestrated incident response.
Question 3: In FortiSOAR, what is a playbook?
- A document containing contact information for the incident response team
- A visual, automated workflow that defines the sequence of actions taken in response to a security event (Correct answer)
- A dashboard showing real-time threat metrics
- A firewall policy set that blocks known malicious IPs
Correct answer: A visual, automated workflow that defines the sequence of actions taken in response to a security event
A playbook in FortiSOAR is a visual automated workflow — a series of defined steps and decisions executed in response to a specific alert or event type.
Question 4: Which integration mechanism does FortiSOAR primarily use to connect with third-party security tools?
- SNMP traps
- Syslog over UDP
- REST API connectors (Correct answer)
- LDAP queries
Correct answer: REST API connectors
FortiSOAR uses REST API-based connectors to integrate with third-party tools, enabling data exchange and action execution across the security ecosystem.
Question 5: What is the key difference between automation and orchestration in the context of SOAR?
- Automation handles multi-tool coordination while orchestration handles single-task execution
- Automation executes individual tasks without human intervention; orchestration coordinates multiple tools and processes to accomplish a broader workflow (Correct answer)
- Orchestration only applies to cloud environments; automation applies to on-premises systems
- There is no practical difference — the terms are interchangeable
Correct answer: Automation executes individual tasks without human intervention; orchestration coordinates multiple tools and processes to accomplish a broader workflow
Automation refers to executing individual repetitive tasks without human input, while orchestration coordinates the flow across multiple tools and processes to achieve an end-to-end response.
Question 6: In FortiSOAR, which feature allows a playbook to pause and wait for a human analyst to approve or reject an action before continuing?
- War Room
- Approval-based (human-in-the-loop) step (Correct answer)
- Incident Commander
- Threat Intelligence Feed
Correct answer: Approval-based (human-in-the-loop) step
FortiSOAR supports human-in-the-loop steps within playbooks, which pause automated execution and request analyst approval before proceeding with high-impact actions.
Question 7: What does MTTR stand for, and how does SOAR directly impact it?
- Mean Time to Remediate; SOAR increases it by adding workflow complexity
- Mean Time to Respond; SOAR reduces it by automating triage and response actions (Correct answer)
- Maximum Threat Tolerance Ratio; SOAR tracks it via dashboards
- Median Ticket Transfer Rate; SOAR routes tickets between teams automatically
Correct answer: Mean Time to Respond; SOAR reduces it by automating triage and response actions
MTTR (Mean Time to Respond) measures how quickly incidents are addressed; SOAR reduces MTTR by automating alert triage, enrichment, and response steps that would otherwise require manual effort.
FCP Security Automation & Orchestration (SOAR) 1
What is the primary purpose of SOAR (Security Orchestration, Automation and Response) in a security operations center?