FCP Security Automation & Orchestration (SOAR) 2

Question 1

What is the role of a connector in FortiSOAR?

Accepted Answer

A connector is a pre-built integration module that enables FortiSOAR to interact with a specific third-party tool or service

Answer

Connectors in FortiSOAR are modular integration packages that define how FortiSOAR communicates with and executes actions on external tools such as firewalls, EDR solutions, or threat intelligence platforms.

Question 2

Which FortiSOAR feature provides a collaborative workspace where multiple analysts can work together on a major security incident in real time?

Accepted Answer

War Room

Answer

The War Room in FortiSOAR is a dedicated collaborative environment where multiple analysts can communicate, share findings, and coordinate response actions on critical incidents simultaneously.

Question 3

In FortiSOAR, what is the primary function of case management?

Accepted Answer

Storing and organizing all data, evidence, actions, and communications related to a security incident in one place

Answer

Case management in FortiSOAR centralizes all incident-related information — alerts, evidence, tasks, notes, and timeline — providing a single pane of glass for the entire investigation lifecycle.

Question 4

FortiSOAR playbooks can be triggered by which of the following events?

Accepted Answer

By alert ingestion, manual triggers, schedule-based triggers, or API calls

Answer

FortiSOAR supports multiple trigger types for playbooks: automatic triggers based on incoming alerts, manual triggers by analysts, scheduled (time-based) triggers, and external API-initiated triggers.

Question 5

What data format is most commonly used for sharing threat intelligence indicators between SOAR platforms and threat intelligence tools?

Accepted Answer

STIX/TAXII

Answer

STIX (Structured Threat Information Expression) and TAXII (Trusted Automated eXchange of Intelligence Information) are the industry-standard formats for structured threat intelligence sharing between security platforms.

(FCP) Fortinet Certified Professional Security Operations Practice Test

(FCP) Fortinet Certified Professional Security Operations Practice Test

FCP Security Automation & Orchestration (SOAR) 2