FCP Security Automation & Orchestration (SOAR) 3

Question 1

When FortiSOAR integrates with FortiSIEM, what is the primary benefit of this integration for SOC operations?

Accepted Answer

FortiSIEM sends correlated security alerts to FortiSOAR, which then automates the response workflow

Answer

FortiSIEM provides firewall rule management capabilities to FortiSOAR

Answer

FortiSOAR replaces FortiSIEM as the log aggregation platform

Answer

FortiSIEM acts as the SOAR playbook execution engine for FortiSOAR

Question 2

In a FortiSOAR playbook, what is the purpose of a decision node (conditional step)?

Accepted Answer

To branch the playbook workflow based on evaluated conditions, enabling different response paths for different scenarios

Answer

To terminate a playbook when an error is encountered

Answer

To notify analysts via email when a playbook completes

Answer

To log all playbook actions to an external SIEM

Question 3

Which of the following is a key metric used to measure the effectiveness of a SOAR implementation in a SOC?

Accepted Answer

Reduction in Mean Time to Detect (MTTD) and Mean Time to Respond (MTTR)

Answer

Number of firewalls managed by the SOAR platform

Answer

Total storage consumed by playbook logs

Answer

Number of analyst certifications completed per quarter

Question 4

What is the function of the FortiSOAR audit trail (timeline) feature for an incident?

Accepted Answer

It provides a chronological record of all actions, analyst notes, playbook executions, and status changes related to an incident

Answer

It generates a network diagram of all systems involved in the incident

Answer

It automatically submits incident details to a government cybersecurity agency

Answer

It schedules future review dates for recurring incidents

Question 5

An analyst wants to automate the containment of an endpoint suspected of being infected with malware using FortiSOAR. Which approach best represents proper SOAR automation?

Accepted Answer

Create a playbook that uses the FortiClient EMS connector to automatically isolate the endpoint, then notifies the analyst of the action taken

Answer

Manually log into FortiClient EMS, find the endpoint, and isolate it

Answer

Send a mass email to all users warning them not to use their endpoints

Answer

Disable the Active Directory account associated with the infected machine

Question 6

Which FortiSOAR feature enables SOC managers to track analyst performance, playbook execution rates, and incident resolution times?

Accepted Answer

Reporting and Dashboards

Answer

Threat Intelligence Feed Manager

Answer

Connector Marketplace

Answer

War Room

Question 7

When designing a SOAR playbook for phishing email response, which sequence of automated actions represents best practice?

Accepted Answer

Enrich the sender domain and URLs → check against threat intelligence → quarantine the email → block the sender domain if malicious → create an incident and notify the analyst

Answer

Delete all emails from the sender → notify IT → close the case

Answer

Forward the phishing email to all users as a training exercise → log the event → auto-close the alert

Answer

Immediately block the sender's entire IP range at the ISP level without further investigation