FCP Security Automation & Orchestration (SOAR) 2

Question 1

What is the role of a connector in FortiSOAR?

Accepted Answer

A connector is a pre-built integration module that enables FortiSOAR to interact with a specific third-party tool or service

Answer

A connector defines the structure of an incident alert

Answer

A connector routes network packets between security zones

Answer

A connector stores enriched threat intelligence in a local database

Question 2

Which FortiSOAR feature provides a collaborative workspace where multiple analysts can work together on a major security incident in real time?

Accepted Answer

War Room

Answer

Incident Queue

Answer

Playbook Designer

Answer

Threat Feed Manager

Question 3

In FortiSOAR, what is the primary function of case management?

Accepted Answer

Storing and organizing all data, evidence, actions, and communications related to a security incident in one place

Answer

Generating compliance reports for auditors

Answer

Automatically patching vulnerable systems identified during an incident

Answer

Scheduling analyst shifts for 24/7 SOC coverage

Question 4

FortiSOAR playbooks can be triggered by which of the following events?

Accepted Answer

By alert ingestion, manual triggers, schedule-based triggers, or API calls

Answer

Only by manual analyst initiation

Answer

Only by scheduled cron jobs

Answer

Only when a new user account is created in Active Directory

Question 5

What data format is most commonly used for sharing threat intelligence indicators between SOAR platforms and threat intelligence tools?

Accepted Answer

STIX/TAXII

Answer

CSV flat files

Answer

NetFlow v9

Answer

SNMP MIB

Question 6

Which of the following best describes IoC enrichment within a FortiSOAR automated playbook?

Accepted Answer

Querying threat intelligence sources to add context (such as reputation, geolocation, and associated malware families) to a suspicious indicator

Answer

Blocking all IoCs immediately at the perimeter firewall without further analysis

Answer

Removing duplicate alerts from the incident queue

Answer

Converting raw log entries into structured syslog format

Question 7

How does FortiSOAR's role-based access control (RBAC) benefit a security operations team?

Accepted Answer

It restricts access to incidents, playbooks, and data based on user roles, ensuring analysts only see what they are authorized to handle

Answer

It allows all analysts to access any playbook and case regardless of sensitivity

Answer

It automatically promotes junior analysts to senior roles after completing a set number of cases

Answer

It enforces network segmentation policies on connected FortiGate devices