NSE 6 - FortiSOAR 7.6 Analyst Practice Questions & Answers • ExamPrepare

Question 1

A Jinja expression returns an unexpected result. The analyst must check whether the input value is a string, list, dictionary, or another data type.

Which filter should the analyst use?

default
tojson
type_debug
to_nice_json

Select an answer above, then submit your vote. Reading or practicing does not cast a vote.

Question 2

A playbook step uses a For Each loop to process a list of alert records. The loop should run only for alerts whose severity is High.

How should you configure this condition?

Add a loop break condition that checks whether vars.loop_output.severity is High.
Add a playbook trigger condition that checks whether vars.item.severity is High
Add a decision step before the loop to check whether vars.loop_output.severity is High.
Add a condition inside the loop that checks whether vars.item.severity is High.

Select an answer above, then submit your vote. Reading or practicing does not cast a vote.

Question 3

A third-party connector returns this alert data:

{
"alert": {
"id": "ALRT-1007",
"source": "ThirdPartySIEM",
"severity": "Informational",
"description": "Suspicious login from unusual location" }
}

The analyst's playbook uses the normalized severity value "minimal" in a condition to route minimal-priority alerts, so the connector value must match the value expected by the condition.

However, this Jinja expression is not returning "minimal":
{{ alert.severity | lower | replace("Informational", "minimal") }}

What is wrong with the Jinja expression?

The replace filter can be used only on lists.
The alert.severity value is not a string.
The lower filter changes the value to lowercase before replace runs.
The replace filter does not work with dot notation.

Select an answer above, then submit your vote. Reading or practicing does not cast a vote.

Question 4

Select an answer above, then submit your vote. Reading or practicing does not cast a vote.

Question 5

An analyst sees an updated connector on the public FortiSOAR content hub site. The connector includes new actions that are needed for a playbook. However, the updated connector version does not appear on the local FortiSOAR content hub page.

The analyst waited for a day and then verified that the FortiSOAR node has connectivity and DNS resolution to repo.fortisoar.fortinet.com.

What should the analyst do?

Restart the cyops-integration-agent service.
Run a connector health check.
Run a forced content hub synchronization from the CLI.
Ensure the csadmin user has update permissions to the content hub module.

Select an answer above, then submit your vote. Reading or practicing does not cast a vote.

Question 6

Refer to the exhibits.

An analyst configured a manual trigger that requires input.

Which two methods can the analyst use to access the dynamic input variable in the next step? (Choose two.)

Input prompt

Playbook steps

Select the value from the dynamic values window under Input > Parameters > triggerInput .
Use a dynamic function to retrieve the manual trigger input value.
Use the json_query filter to retrieve the manual trigger input value from the input record.
Enter {{vars.input.params.triggerInput}} manually.
Enter {{vars.trigger.Start.triggerInput}} manually.

Select an answer above, then submit your vote. Reading or practicing does not cast a vote.