FCP Security Automation & Orchestration (SOAR)

Question 1

What is the primary purpose of SOAR (Security Orchestration, Automation and Response) in a security operations center?

Accepted Answer

To automate repetitive security tasks and orchestrate tools for faster incident response

Answer

To replace human analysts entirely with AI-driven decisions

Answer

To store and archive all security logs in a central repository

Answer

To scan networks for open ports and vulnerabilities

Question 2

Which Fortinet product is the dedicated SOAR solution for automating security workflows and managing incidents?

Accepted Answer

FortiSOAR

Answer

FortiSIEM

Answer

FortiAnalyzer

Answer

FortiManager

Question 3

In FortiSOAR, what is a playbook?

Accepted Answer

A visual, automated workflow that defines the sequence of actions taken in response to a security event

Answer

A document containing contact information for the incident response team

Answer

A dashboard showing real-time threat metrics

Answer

A firewall policy set that blocks known malicious IPs

Question 4

Which integration mechanism does FortiSOAR primarily use to connect with third-party security tools?

Accepted Answer

REST API connectors

Answer

SNMP traps

Answer

Syslog over UDP

Answer

LDAP queries

Question 5

What is the key difference between automation and orchestration in the context of SOAR?

Accepted Answer

Automation executes individual tasks without human intervention; orchestration coordinates multiple tools and processes to accomplish a broader workflow

Answer

Automation handles multi-tool coordination while orchestration handles single-task execution

Answer

Orchestration only applies to cloud environments; automation applies to on-premises systems

Answer

There is no practical difference — the terms are interchangeable

Question 6

In FortiSOAR, which feature allows a playbook to pause and wait for a human analyst to approve or reject an action before continuing?

Accepted Answer

Approval-based (human-in-the-loop) step

Answer

War Room

Answer

Incident Commander

Answer

Threat Intelligence Feed

Question 7

What does MTTR stand for, and how does SOAR directly impact it?

Accepted Answer

Mean Time to Respond; SOAR reduces it by automating triage and response actions

Answer

Mean Time to Remediate; SOAR increases it by adding workflow complexity

Answer

Maximum Threat Tolerance Ratio; SOAR tracks it via dashboards

Answer

Median Ticket Transfer Rate; SOAR routes tickets between teams automatically