FCP Security Automation & Orchestration (SOAR) 3

Question 1

When FortiSOAR integrates with FortiSIEM, what is the primary benefit of this integration for SOC operations?

Accepted Answer

FortiSIEM sends correlated security alerts to FortiSOAR, which then automates the response workflow

Answer

FortiSIEM detects and correlates events into incidents, then forwards them to FortiSOAR where automated playbooks execute the appropriate response actions, creating a complete detect-to-respond pipeline.

Question 2

In a FortiSOAR playbook, what is the purpose of a decision node (conditional step)?

Accepted Answer

To branch the playbook workflow based on evaluated conditions, enabling different response paths for different scenarios

Answer

Decision nodes in FortiSOAR evaluate a condition (such as the severity of an alert) and branch the playbook into different execution paths, allowing a single playbook to handle multiple scenarios intelligently.

Question 3

Which of the following is a key metric used to measure the effectiveness of a SOAR implementation in a SOC?

Accepted Answer

Reduction in Mean Time to Detect (MTTD) and Mean Time to Respond (MTTR)

Answer

MTTD and MTTR are the primary KPIs for SOAR effectiveness — a well-implemented SOAR platform measurably reduces the time to both detect and respond to security incidents.

Question 4

What is the function of the FortiSOAR audit trail (timeline) feature for an incident?

Accepted Answer

It provides a chronological record of all actions, analyst notes, playbook executions, and status changes related to an incident

Answer

The audit trail in FortiSOAR records a timestamped history of every action taken on an incident — playbook steps, analyst notes, field changes — supporting investigation integrity and post-incident review.

Question 5

An analyst wants to automate the containment of an endpoint suspected of being infected with malware using FortiSOAR. Which approach best represents proper SOAR automation?

Accepted Answer

Create a playbook that uses the FortiClient EMS connector to automatically isolate the endpoint, then notifies the analyst of the action taken

Answer

The correct SOAR approach is to build a playbook leveraging the FortiClient EMS connector to automatically isolate the suspicious endpoint and then notify the analyst, combining speed with visibility.

(FCP) Fortinet Certified Professional Security Operations Practice Test

(FCP) Fortinet Certified Professional Security Operations Practice Test

FCP Security Automation & Orchestration (SOAR) 3