I85PREP
⌘ K
FortiSOAR Administrator study materials
FortiSOAR Administrator study resources

FortiSOAR Administrator practice questions

One question at a time. Build your FortiSOAR Administrator understanding.

First 50 of 190 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1FortiSOAR-style cases, playbooks, connectors and controlled automation

Which listed combination of capabilities describes the core purpose of a SOAR platform such as FortiSOAR?

  1. A SIEM and a vulnerability scanner
  2. Case management and security orchestration with automation Correct answer.
  3. An IDS and a packet broker
  4. A CASB and a DLP gateway

Explanation

SOAR (Security Orchestration, Automation, and Response) platforms are defined by Gartner as combining case/incident management with security orchestration and automation. FortiSOAR delivers both: workflows (playbooks) that orchestrate connectors, and modules (alerts, incidents, war rooms) for case management.

Question 2FortiSOAR-style cases, playbooks, connectors and controlled automation

FortiSOAR ships as a 64-bit hardened virtual appliance. Which Linux distribution is the FortiSOAR 7.3 VM built on?

  1. Ubuntu 22.04 LTS
  2. Rocky Linux Correct answer.
  3. Debian 11
  4. FortiOS

Explanation

Beginning with the 7.x line, the FortiSOAR virtual appliance is delivered as a hardened, preconfigured Rocky Linux VM. This replaces the earlier CentOS-based image after CentOS Linux was discontinued.

Question 3FortiSOAR-style cases, playbooks, connectors and controlled automation

An MSSP plans to deploy FortiSOAR with full data isolation between customer environments, where each tenant runs its own FortiSOAR instance and forwards visibility to a master node. Which deployment model is required?

  1. Shared multi-tenancy
  2. Distributed multi-tenancy Correct answer.
  3. Single-node Enterprise license
  4. Active-active HA only

Explanation

Distributed multi-tenancy is designed for MSSPs whose tenants need full data isolation. Each tenant runs its own FortiSOAR instance and replicates selected records to a master node that has cross-tenant visibility.

Question 4FortiSOAR-style cases, playbooks, connectors and controlled automation

Which two FortiSOAR license editions enable multi-tenancy on the master node and on a tenant node, respectively?

  1. Enterprise and Enterprise_Tenant
  2. MT and MT_Tenant Correct answer.
  3. MSSP and MSSP_Branch
  4. Tenant_Master and Tenant_Customer

Explanation

FortiSOAR uses MT to license a node as the master in a multi-tenant deployment and MT_Tenant to license a node as a tenant (customer) instance. The Enterprise license is for single-tenant production deployments.

Question 5FortiSOAR-style cases, playbooks, connectors and controlled automation

In FortiSOAR, what is the primary distinction between an alert and an incident?

  1. Alerts come from email; incidents come from SIEM only
  2. Alerts are individual security events ingested for triage; incidents group correlated alerts that share a common threat or campaign Correct answer.
  3. Alerts are read-only and incidents are read-write
  4. Alerts are open-source and incidents are paid features

Explanation

FortiSOAR ingests alerts from sources such as SIEM, EDR, and email gateways. Analysts triage alerts and, when several alerts represent a coordinated activity, they are grouped under an incident record for deeper investigation, response, and reporting.

Question 6FortiSOAR-style cases, playbooks, connectors and controlled automation

What is the recommended action when the same alert is ingested multiple times from different log sources?

  1. Delete the duplicate alerts manually
  2. Use deduplication rules so duplicates are merged onto an existing alert record Correct answer.
  3. Disable the second log source
  4. Promote each duplicate to its own incident

Explanation

FortiSOAR ships deduplication logic that uses a configurable lookup field (such as a vendor alert ID or hash of source/destination/signature) so repeat ingestions update an existing record instead of creating new ones. This keeps queues clean and triage focused.

Question 7FortiSOAR-style cases, playbooks, connectors and controlled automation

Which framework does FortiSOAR use to map alert and incident techniques so analysts can pivot from indicators to adversary tactics?

  1. OWASP Top 10
  2. NIST 800-53
  3. MITRE ATT&CK Correct answer.
  4. CVSS v3

Explanation

FortiSOAR maps alert and incident records to MITRE ATT&CK tactics and techniques. The ATT&CK navigator and ICS view help SOC analysts understand adversary behavior and chain related alerts into a campaign-level incident.

Question 8FortiSOAR-style cases, playbooks, connectors and controlled automation

An organization wants FortiSOAR to automatically suggest severity and incident type values for new alerts based on historical triage decisions. Which built-in feature provides this?

  1. Recommendation Engine Correct answer.
  2. Asset correlator
  3. Indicator enrichment
  4. Reference Block library

Explanation

The FortiSOAR Recommendation Engine trains machine-learning models on historical alert records to predict fields such as Severity and Type for new alerts, accelerating triage. It is configured under System Configuration and requires a representative training data set.

Question 9FortiSOAR-style cases, playbooks, connectors and controlled automation

Which FortiSOAR module is primarily used to track the lifecycle of suspicious files, IPs, URLs, domains, and hashes that appear during an investigation?

  1. Indicators Correct answer.
  2. Assets
  3. Tasks
  4. Communications

Explanation

The Indicators module stores observables such as IPs, URLs, file hashes, domains, and email addresses, including their reputation history, related alerts, and threat-intel context. It is the primary record type for IoCs in FortiSOAR.

Question 10FortiSOAR-style cases, playbooks, connectors and controlled automation

Which deployment model is appropriate when a FortiSOAR customer needs basic redundancy with one active node and one passive node in another data center?

  1. Distributed multi-tenant
  2. Active-passive HA cluster Correct answer.
  3. Active-active HA cluster
  4. Single-node with backups only

Explanation

Active-passive HA places one node in service and one or more standby nodes that asynchronously receive replicated data. If the primary fails, an administrator can promote the passive node - a common DR pattern when the standby is in a remote site.

Question 11FortiSOAR-style cases, playbooks, connectors and controlled automation

When activating the FortiSOAR license, which Fortinet service does the appliance contact to validate entitlement?

  1. FortiAnalyzer
  2. FortiCloud / FortiCare Correct answer.
  3. FortiManager
  4. FortiAuthenticator

Explanation

FortiSOAR uses FortiCloud / FortiCare for license activation and entitlement validation. The appliance must reach FortiCare on the public Internet (or via an HTTPS proxy) for online activation; an offline license file workflow is also supported.

Question 12FortiSOAR-style cases, playbooks, connectors and controlled automation

A new FortiSOAR VM has been deployed but cannot reach the Internet directly. Which configuration step lets it activate its license and download connectors through the corporate egress?

  1. Disable HTTPS inspection on the firewall
  2. Configure a system HTTP/HTTPS proxy in FortiSOAR Correct answer.
  3. Add a default route through FortiAnalyzer
  4. Switch to an offline-only license; proxies are unsupported

Explanation

FortiSOAR supports a system-wide HTTP/HTTPS proxy, configured under System Configuration. With the proxy in place, license activation, connector downloads, and outbound connector traffic can traverse the corporate egress.

Question 13FortiSOAR-style cases, playbooks, connectors and controlled automation

Which tabs are part of a FortiSOAR War Room record by default?

  1. Dashboard, Task Management, Investigate, Communication, and Timeline Correct answer.
  2. Alerts, Incidents, Assets, Indicators
  3. Reports, Dashboards, KPIs
  4. Connectors, Playbooks, Triggers

Explanation

A War Room record provides a structured collaboration space with Dashboard, Task Management, Investigate, Communication, and Timeline tabs so SOC teams can coordinate during major incidents. Policies define which roles can create or join a war room.

Question 14FortiSOAR-style cases, playbooks, connectors and controlled automation

Which SLA-related capability does FortiSOAR provide for alerts?

  1. SLA templates that track response and resolution times against module records Correct answer.
  2. An SLA timer that disables alerts after a deadline
  3. SLA enforcement that fails playbook execution if exceeded
  4. Per-user SLA scoring stored only in the audit log

Explanation

FortiSOAR lets administrators create SLA templates for modules such as Alerts and Indicators. SLA records track response time, resolution time, and breaches, supporting reporting and dashboards on team performance.

Question 15FortiSOAR-style cases, playbooks, connectors and controlled automation

An admin wants to know which connector packs are available out-of-the-box in a fresh FortiSOAR install. Which statement best describes the connector ecosystem?

  1. Only Fortinet connectors ship by default; third-party requires partner license
  2. FortiSOAR ships with hundreds of pre-built connectors and supports custom connectors developed by users or partners Correct answer.
  3. Connectors must be installed manually as RPMs from the OS shell
  4. Only SIEM connectors are supported

Explanation

FortiSOAR provides a large library of pre-built connectors covering Fortinet products and a broad range of third-party SIEM, EDR, ITSM, threat-intel, and cloud platforms. Customers can also build custom connectors using the Connector SDK.

Question 16FortiSOAR-style cases, playbooks, connectors and controlled automation

Which initial-setup task is typically performed FIRST after powering on the FortiSOAR VM?

  1. Run the First-Boot Wizard / csadm commands to set hostname, network, and admin password Correct answer.
  2. Install all 200+ connectors before login
  3. Disable Elasticsearch to save resources
  4. Reformat the data partition for ZFS

Explanation

After first boot, an administrator uses the first-boot wizard or the csadm CLI to set the hostname, network configuration, time zone, and the initial CS Admin / system passwords. Only after these foundations are set should connectors and integrations be configured.

Question 17FortiSOAR-style cases, playbooks, connectors and controlled automation

What is one operational reason an enterprise might choose an active-active FortiSOAR cluster instead of active-passive?

  1. Reduced license cost compared to active-passive
  2. Horizontal scaling - distributing playbook execution and user workload across multiple nodes Correct answer.
  3. Eliminating the need for a database entirely
  4. Single-vendor dependency on FortiAnalyzer for replication

Explanation

Active-active clusters spread workload (workflow execution, user requests) across multiple nodes for horizontal scaling. A load balancer or proxy fronts the cluster to distribute traffic. Data is replicated asynchronously between nodes.

Question 18FortiSOAR-style cases, playbooks, connectors and controlled automation

Which Fortinet certification track does the NSE 6 - FortiSOAR 7.3 Administrator exam contribute to?

  1. FCSS in Network Security
  2. FCSS in Security Operations Correct answer.
  3. FCSS in Public Cloud Security
  4. FCSS in OT Security

Explanation

The NSE 6 - FortiSOAR 7.3 Administrator (NSE6_FSR-7.3) exam counts toward the FCSS in Security Operations track, which validates SOC-focused skills across FortiSOAR, FortiAnalyzer, and FortiSIEM.

Question 19FortiSOAR-style cases, playbooks, connectors and controlled automation

Which two records are typically promoted into a war room when a major breach is being coordinated?

  1. Audit log entries and alert correlation rules
  2. An incident record and the related alerts/indicators that scope the investigation Correct answer.
  3. Reports and dashboards
  4. Connector configuration and license keys

Explanation

War rooms are built around an incident record and pull in supporting alerts, indicators, assets, and tasks so coordinators have one workspace. Communication, timeline, and task tabs let multiple analysts execute response actions in parallel.

Question 20FortiSOAR-style cases, playbooks, connectors and controlled automation

An organization wants FortiSOAR to ingest alerts from FortiAnalyzer, enrich them via VirusTotal, and open ServiceNow tickets. What is the minimum FortiSOAR license edition needed for a single-tenant production deployment?

  1. Trial only
  2. Enterprise Correct answer.
  3. MT (Multi-Tenant)
  4. Community Edition

Explanation

Single-tenant production deployments use the FortiSOAR Enterprise license. MT/MT_Tenant licenses are required only for shared or distributed multi-tenant (MSSP) deployments. Trial and community editions are not appropriate for production.

Question 21Host and middleware hardening foundations

In the supplied Elasticsearch component model using default TCP ports 9200 and 9300, which service pair do those ports identify?

  1. PostgreSQL primary and replica
  2. Elasticsearch REST API and inter-node transport Correct answer.
  3. RabbitMQ AMQP and management UI
  4. Cyops-tomcat and cyops-auth

Explanation

In the supplied Elasticsearch default-port model,9200 is theHTTP API and 9300 the inter-node transport endpoint. Actual deployment ports and allowed peers are configurable; this does not justify exposing either service to every network or establish the architecture of every FortiSOAR version.

Question 22Host and middleware hardening foundations

Which port does the embedded PostgreSQL database in FortiSOAR listen on by default?

  1. TCP 1433
  2. TCP 3306
  3. TCP 5432 Correct answer.
  4. TCP 1521

Explanation

FortiSOAR's internal (or externalized) PostgreSQL database listens on TCP/5432 - the standard PostgreSQL port. It can be externalized to a separate PostgreSQL host for scale.

Question 23Host and middleware hardening foundations

A FortiSOAR administrator wants to externalize the PostgreSQL database to a managed instance. Which statement is correct?

  1. Externalization is unsupported in FortiSOAR 7.3
  2. FortiSOAR supports an externalized PostgreSQL database; the internal DB can be migrated to an external server Correct answer.
  3. Only SQL Server is supported as the external DB
  4. The Elasticsearch indices migrate with PostgreSQL automatically

Explanation

FortiSOAR 7.3 supports either the bundled internal PostgreSQL or an externalized PostgreSQL server. Externalization is documented as a supported migration path, often for scale or DBA-managed environments.

Question 24Host and middleware hardening foundations

Which FortiSOAR service is responsible for messaging and queueing playbook execution between components?

  1. RabbitMQ Correct answer.
  2. Elasticsearch
  3. PostgreSQL
  4. cyops-postman

Explanation

RabbitMQ provides the asynchronous message bus that links the workflow engine with integration agents and other services. Most playbook scheduling and inter-service communication relies on RabbitMQ.

Question 25Host and middleware hardening foundations

Which FortiSOAR service hosts the Tomcat-based gateway and notifier components on TCP/8080?

  1. fsr-workflow
  2. cyops-tomcat Correct answer.
  3. cyops-integrations-agent
  4. cyops-auth

Explanation

cyops-tomcat hosts the cyops-gateway and cyops-notifier applications on TCP/8080. Other services such as cyops-auth (8443), cyops-integrations-agent (9595), fsr-workflow (8888), and cyops-postman (7575) run on different ports.

Question 26Host and middleware hardening foundations

Where in FortiSOAR are configuration changes (such as creating new users, roles, or modules) recorded for compliance review?

  1. /var/log/secure on each node
  2. The Audit Log under System Configuration Correct answer.
  3. The Communications module
  4. The connector store

Explanation

FortiSOAR's Audit Log captures who changed what and when, including configuration changes, login events, record updates, and playbook executions. It is exposed through the System Configuration UI and can be exported.

Question 27Host and middleware hardening foundations

A SOC team wants to add a new field to the Alerts module without writing code. Which FortiSOAR feature allows this?

  1. Module Editor / Custom Modules with picklists and field definitions Correct answer.
  2. Direct edits to the PostgreSQL schema
  3. Custom REST endpoints in cyops-auth
  4. FortiAnalyzer custom dataset

Explanation

The Module Editor lets administrators add fields, picklists (drop-down values), and references to existing modules, or create entirely new custom modules. The platform updates the UI, search index, and APIs accordingly without code or DB changes.

Question 28Host and middleware hardening foundations

An admin needs to migrate playbooks, modules, and dashboards from a staging FortiSOAR to production. Which feature is designed for this?

  1. Manual SQL exports
  2. Configuration Manager / Configuration import/export Correct answer.
  3. Live database mirroring
  4. Cloning the entire VM

Explanation

FortiSOAR ships a Configuration Manager that exports and imports collections of configuration artifacts (playbooks, modules, roles, dashboards, picklists). This is the supported way to promote work from staging to production.

Question 29Host and middleware hardening foundations

Which statement about FortiSOAR backups is correct?

  1. Backups can be scheduled and target the file system or external storage; restores reload PostgreSQL and configuration Correct answer.
  2. FortiSOAR has no built-in backup mechanism
  3. Backups only capture playbook XML, not records
  4. Backups must be created from the OS shell using mysqldump

Explanation

FortiSOAR includes a built-in backup utility that schedules and stores backups locally or to remote storage. Backups include the PostgreSQL database and key configuration. Restoration is supported on a fresh node of the same version.

Question 30Host and middleware hardening foundations

Which fixture-related capability does FortiSOAR provide?

  1. Pre-populated reference data (fixtures) for picklists, modules, dashboards, and connector configurations Correct answer.
  2. Hardware fixture racks for the appliance
  3. Optical fixtures for FortiSOAR sensors
  4. A FixturesQL macro language

Explanation

Fixtures in FortiSOAR are bundles of reference data (picklist values, dashboards, default modules, sample data) that can be loaded to bootstrap a new install or reset a development environment quickly.

Question 31Host and middleware hardening foundations

An administrator promotes the passive node in an active-passive HA cluster after the primary fails. Which CLI utility is used to perform the takeover?

  1. csadm Correct answer.
  2. fos-cli
  3. haproxy-ctl
  4. rabbitmqctl

Explanation

The csadm administration CLI manages the FortiSOAR cluster, including the takeover operation that promotes a passive node to primary. csadm also handles backup, network, and certificate operations.

Question 32Host and middleware hardening foundations

When building a FortiSOAR HA cluster from a restored node, which security artifact must be regenerated?

  1. RabbitMQ certificates Correct answer.
  2. FortiCare contract numbers
  3. PostgreSQL TDE keys
  4. Elasticsearch user passwords

Explanation

When you build an HA cluster using a node restored from backup, RabbitMQ certificates must be regenerated so the cluster nodes can establish trusted broker communication. This is documented in the HA setup procedure.

Question 33Host and middleware hardening foundations

Which FortiSOAR component handles full-text search across records and files?

  1. PostgreSQL with GIN indexes
  2. Elasticsearch Correct answer.
  3. RabbitMQ
  4. cyops-postman

Explanation

FortiSOAR uses Elasticsearch to deliver fast full-text search across all records, attachments, and audit data. PostgreSQL holds canonical relational records; Elasticsearch handles the search index.

Question 34Host and middleware hardening foundations

An administrator wants to scale Elasticsearch independently of FortiSOAR application services. Which architectural option does FortiSOAR support?

  1. Externalize Elasticsearch onto a dedicated cluster with authentication Correct answer.
  2. Replace Elasticsearch with OpenSearch by editing the systemd unit
  3. Use SQLite as a search backend for low-volume environments
  4. Disable Elasticsearch entirely; PostgreSQL covers search

Explanation

FortiSOAR supports externalizing Elasticsearch to a dedicated cluster, including authentication (TLS and credentials). This is recommended when search volume or retention requirements outgrow the embedded Elasticsearch.

Question 35Host and middleware hardening foundations

Which RabbitMQ default port pair maps to AMQP TLS and the management UI in FortiSOAR?

  1. 5671 and 15672 Correct answer.
  2. 9200 and 9300
  3. 5432 and 8080
  4. 443 and 80

Explanation

AMQP over TLS uses TCP/5671 (with 5672 for plaintext AMQP), and the RabbitMQ management UI uses TCP/15672. These ports may need to be reachable in clustered FortiSOAR deployments.

Question 36Host and middleware hardening foundations

An administrator needs to import a CSV of historical alerts into the Alerts module. Which feature should they use?

  1. Data import wizard / file upload to module Correct answer.
  2. Direct PostgreSQL COPY command
  3. Replicate the CSV to /opt/cyops/data
  4. Copy-paste each record manually

Explanation

FortiSOAR provides a data import wizard that maps CSV columns to module fields and supports preview and dedupe. This is the supported way to import historical or bulk data.

Question 37Host and middleware hardening foundations

Which file or service should be checked first when the FortiSOAR UI returns a 502 Bad Gateway error?

  1. PostgreSQL replication slots
  2. Status of cyops-tomcat / Nginx and underlying application services Correct answer.
  3. RabbitMQ shovel plugin
  4. /etc/hosts entries on the analyst's workstation

Explanation

A 502 from the FortiSOAR front end usually means the reverse-proxy layer (Nginx) cannot reach the application backend. Check the status of cyops-tomcat and other application services first; restart with csadm or systemctl as needed.

Question 38Host and middleware hardening foundations

A FortiSOAR administrator wants to confirm the running version and applied patches. Which is the canonical way to check the appliance version?

  1. Read /etc/redhat-release
  2. Check the System Configuration > About / version page in the UI Correct answer.
  3. Query FortiCloud directly
  4. Run rpm -qa | grep linux

Explanation

The System Configuration About / version page shows the FortiSOAR product version and patches applied. The csadm CLI also prints the version, and license metadata reflects the current SKU and edition.

Question 39Host and middleware hardening foundations

Which approach is recommended to keep FortiSOAR connectors up to date after initial install?

  1. Disable connector updates and stay on the original versions
  2. Use the Connector Store inside FortiSOAR to install/upgrade connectors Correct answer.
  3. Compile each connector from GitHub manually
  4. Have analysts build their own RPMs and copy them via SCP

Explanation

The Connector Store is the supported channel to install and upgrade connectors. It tracks dependencies, version compatibility, and can apply updates centrally. Custom connectors can be sideloaded as packages, but supported connectors should come from the store.

Question 40Host and middleware hardening foundations

Which port does the cyops-integrations-agent listen on by default for connector executor communication?

  1. TCP 8080
  2. TCP 8443
  3. TCP 9595 Correct answer.
  4. TCP 7575

Explanation

The cyops-integrations-agent service runs on TCP/9595 and is responsible for executing connector actions inside FortiSOAR. Other integration services include cyops-tomcat (8080), cyops-auth (8443), and cyops-postman (7575).

Question 41Identity, access and cryptographic protection

Which FortiSOAR security primitive determines what CRUD operations a user can perform on a module?

  1. Roles with CRUD-style permissions per module Correct answer.
  2. Individual user passwords
  3. PostgreSQL row-level security only
  4. MITRE ATT&CK matrix mapping

Explanation

Role permissions govern supported module operations in the actual platform model. Teams, record ownership/scope, connector permissions and other settings may also affect effective access, so evaluate the actual combination rather than assume one universal union/intersection formula. Password knowledge alone is not the module authorization rule.

Question 42Identity, access and cryptographic protection

How does team membership interact with role permissions in FortiSOAR?

  1. Roles authorize actions on modules; teams scope which records (record ownership) the user can act on Correct answer.
  2. Teams override roles when both are assigned
  3. Roles apply only to playbooks; teams apply only to alerts
  4. Teams replace roles for SOC managers

Explanation

FortiSOAR combines role-based permissions with team-based record ownership: roles say 'what you can do' (Read alerts, Update incidents) and teams say 'which records you can do it to'. The intersection is the user's effective access.

Question 43Identity, access and cryptographic protection

Which built-in role in FortiSOAR has broad privileges including assigning permissions to other teams?

  1. T0 Analyst
  2. Security Administrator
  3. Application Administrator Correct answer.
  4. Read-only Reporter

Explanation

The Application Administrator default role holds broad privileges - including the ability to assign permissions to other teams and roles. It is the highest-privilege application role and should be granted sparingly.

Question 44Identity, access and cryptographic protection

Which authentication method allows FortiSOAR to delegate user authentication to a corporate identity provider without storing credentials in FortiSOAR?

  1. Local username and password
  2. SAML 2.0 Correct answer.
  3. FortiSOAR API key
  4. Plain LDAP simple bind only

Explanation

SAML 2.0 lets FortiSOAR trust an external IdP (Okta, ADFS, Azure AD) to authenticate users. FortiSOAR maps SAML assertions (group/role) to local roles and teams. Credentials never live in FortiSOAR.

Question 45Identity, access and cryptographic protection

An administrator integrates FortiSOAR with Active Directory to authenticate analysts and auto-map their AD groups to FortiSOAR roles. Which authentication method is used?

  1. LDAP / LDAPS with group attribute mapping Correct answer.
  2. Kerberos with GPO only
  3. OAuth client credentials grant
  4. TACACS+

Explanation

FortiSOAR supports LDAP/LDAPS to authenticate users against Active Directory and map AD group membership to FortiSOAR roles. LDAPS over TLS is recommended.

Question 46Identity, access and cryptographic protection

Which capability allows a FortiSOAR administrator to limit which records a user can see based on attributes rather than only on team ownership?

  1. Attribute-Based Access Control (ABAC) using record fields Correct answer.
  2. Disabling Elasticsearch for the user
  3. Static IP allowlists
  4. Connector-only mode

Explanation

FortiSOAR supports attribute-based access control using fields on records (such as severity or classification) so policy can hide records that do not match a user's attribute permissions. This complements team-based ownership.

Question 47Identity, access and cryptographic protection

Which two values must be assigned to a user account so they can read alerts and edit only their team's incidents?

  1. A role granting Read on Alerts and Update on Incidents, plus team membership for the relevant team(s) Correct answer.
  2. An LDAP password hash and a SAML cert
  3. A connector key and an Elasticsearch token
  4. A custom module field plus an audit-log entry

Explanation

Access in FortiSOAR is the intersection of role permissions and team ownership. A role granting the right CRUD permissions, combined with membership in the team(s) that own the relevant records, achieves the desired effect.

Question 48Identity, access and cryptographic protection

Why is the principle of least privilege especially important for the FortiSOAR Playbooks module?

  1. Playbooks can execute privileged actions across many integrated systems, so misuse can have outsized impact Correct answer.
  2. Playbooks store every user's password
  3. Playbooks bypass Elasticsearch indexing
  4. Playbooks are billed per execution

Explanation

Playbooks orchestrate actions across many systems (firewalls, EDR, ticketing) often using privileged credentials. Granting Execute on Playbooks broadly can let a low-privilege user trigger powerful changes. RBAC must be tight.

Question 49Identity, access and cryptographic protection

An MSSP wants tenant analysts to see only their tenant's records inside a single shared FortiSOAR instance. Which mechanism enforces this isolation?

  1. Shared multi-tenancy with per-tenant teams and ABAC Correct answer.
  2. Distributed tenancy with separate VMs
  3. A separate Elasticsearch cluster per analyst
  4. Disabling the war room module

Explanation

Shared multi-tenancy assigns each tenant to its own teams (and optionally tenant attributes), so analysts only see records owned by their tenant's teams. Combined with attribute-based controls, it provides logical isolation in one instance.

Question 50Identity, access and cryptographic protection

What is the safest approach when an analyst needs temporary elevated permissions to investigate a major incident?

  1. Permanently grant Application Administrator
  2. Add the analyst to a privileged role for the duration of the investigation, then remove it; document via audit log Correct answer.
  3. Share the admin password
  4. Disable the audit log to avoid noise

Explanation

Time-bounded elevation through a privileged role assignment, with the change captured in the audit log, follows least privilege and accountability. Permanent admin rights or shared credentials violate both principles.