Latest Apr 15, 2026 NSE6_FSR-7.3 Brain Dump: A Study Guide with Tips & Tricks for passing Exam
NSE6_FSR-7.3 Question Bank: Free PDF Download Recently Updated Questions
NEW QUESTION # 12
An administrator is issuing the following command on a node trying to join a FortiSOAR duster as a standby: csadm ha join-cluster --status active -role secondary --primary-node 10.0.1.160 The node fails to join the cluster. What is the issue?
- A. The role value should be worker.
- B. The status value should be passive.
- C. The primary node needs to be resolvable via FQDN.
- D. The IP address should be for secondary-node Instead of primary-node.
Answer: B
Explanation:
When joining a FortiSOAR cluster as a standby node, the correct status value should be passive. Using active would imply that the node is trying to join as an active node, which could cause conflicts in the cluster setup. In FortiSOAR, standby nodes must be set as passive to ensure they are recognized correctly and to avoid conflicts with the primary node or other active nodes within the cluster. Therefore, setting the status to passive will resolve the issue and allow the node to join the cluster as intended.
NEW QUESTION # 13
Which two statements about appliance users are true? (Choose two.)
- A. Appliance users use two-factor authentication for messages sent to the API.
- B. Appliance users represent non-human users.
- C. Appliance users do not have a login ID and do not add to the license count.
- D. Appliance users use time-expiring tokens for primary authentication.
Answer: B,C
Explanation:
In FortiSOAR, appliance users are accounts that represent non-human entities, such as system processes or integrations. These users do not require login IDs and therefore do not contribute to the licensing user count. Appliance users are configured for backend tasks or to interact with external systems, enabling automated processes without consuming standard user licenses. This approach optimizes system resources and keeps licensing costs manageable.
NEW QUESTION # 14
Which two system monitoring reports are available on the System Monitoring widget?
(Choose two.)
- A. CPU Usage
- B. RAM Usage
- C. Service Status
- D. Playbook Health Status
Answer: A,C
NEW QUESTION # 15
When deleting a user account on FortiSOAR, you must enter the user ID in which file on FortiSOAR?
- A. usersToDelete.txt
- B. config_yml
- C. userDelete.txt.
- D. scripts
Answer: A
Explanation:
When deleting a user account in FortiSOAR, the user ID must be entered into the usersToDelete.txt file. This file is specifically used to list users that are marked for deletion. Once the user IDs are listed in this file, the system can process the deletion of these accounts as part of its user management operations. This method ensures that only specified users are deleted, as referenced in FortiSOAR's administrative controls.
NEW QUESTION # 16
Refer to the exhibit.
Why is this user's account inactive? (Choose one answer)
- A. The user has exceeded the maximum number of allowed user accounts.
- B. The user has not reset the password for the account.
- C. The user does not have a valid email ID for the account.
- D. The user has exceeded the maximum number of authentication tries for a one-hour period.
Answer: A
Explanation:
Comprehensive and Detailed Explanation From FortiSOAR 7.3 Exact Extract study guide:
According to the FortiSOAR 7.3 Administration and Deployment Guides, specifically in the "Licensing FortiSOAR" and "Security Management" sections:
* Licensing Enforcement:FortiSOAR strictly enforces the number of active users based on the installed license. The license specifies themaximum number of active usersallowed in the system at any given point in time.
* User Status (Active vs. Inactive):When the number of active users reaches the limit defined by the license, any additional users created or imported will be set to anInactivestatus by default. An administrator cannot change their status to "Active" until an existing active user is deactivated or deleted, or the license is upgraded to support more users.
* Locked Status (Option A):It is important to distinguish between "Inactive" and "Locked." Users becometemporarily lockedout of FortiSOAR when they exceed the configured number of authentication attempts (defaulting to 5 times) within a specific period. A locked user profile will typically display a "Locked" indicator or a checkbox to "Unlock" rather than a simple "Inactive" status.
* Other Options:While an email ID is required for account creation, its validity does not automatically trigger an "Inactive" status (Option B). Similarly, a required password reset (Option C) forces a password change upon login but does not disable the account.
NEW QUESTION # 17
For which two modules on FortiSOAR can you create SLA templates7 (Choose two.)
- A. Tasks
- B. Incidents
- C. Alerts
- D. Indicators
Answer: C,D
Explanation:
In FortiSOAR, SLA (Service Level Agreement) templates can be created for specific modules, including Alerts and Indicators. These templates are essential for tracking response and resolution times, ensuring compliance with defined service levels. By configuring SLAs on the Alerts and Indicators modules, organizations can monitor the time taken to address these items, which is critical in maintaining efficient incident response and management practices. The SLA templates can be customized according to specific business requirements and are applied to records within these modules to enforce timely actions.
NEW QUESTION # 18
The Create Record and Update Record steps are categorized under which playbook step'
- A. Reference
- B. Evaluate
- C. Execute
- D. Core
Answer: D
Explanation:
In FortiSOAR playbooks, the "Create Record" and "Update Record" steps are categorized under the "Core" category of playbook steps. Core steps are essential actions that are frequently used in playbooks to interact with records in the FortiSOAR database. They include fundamental operations such as creating, reading, updating, or deleting records within modules. These steps are crucial for the automation of tasks such as data management, where playbooks need to create new entries or update existing data as part of incident response workflows.
NEW QUESTION # 19
Which two relationship types are configurable on FortiSOAR?
(Choose two.)
- A. Grandparents
- B. Siblings
- C. Parents
- D. Relatives
Answer: B,C
NEW QUESTION # 20
Which three activities can be achieved using the FortiSOAR queue and shift management feature? (Choose three)
- A. Designate a coordinator to monitor queues and shifts
- B. Initiate shift handovers
- C. Generate shift leads and shift members
- D. Set up queue meeting rooms
- E. Create queue rules based on matching conditions
Answer: B,C,E
Explanation:
The FortiSOAR queue and shift management feature enables several key activities for managing shifts and queues. Administrators can initiate shift handovers, allowing for smooth transitions between shift leads and members. They can also designate specific roles within shifts, including shift leads and members, to define responsibilities. Additionally, queue rules can be established based on certain conditions, ensuring that incidents and tasks are assigned according to predefined criteria, which helps streamline operations and improve response times.
NEW QUESTION # 21
On FortiSOAR. which default role is used to assign privileges to other teams and is recommended to not be removed?
- A. Application Administrator
- B. Security Administrator
- C. Playbook Administrator
- D. Full App Permissions
Answer: A
Explanation:
In FortiSOAR, the "Application Administrator" role is a default role that holds broad privileges, including the ability to assign permissions to other teams. This role is fundamental to system administration and is recommended not to be removed as it provides crucial administrative capabilities. Removing or modifying this role could impact FortiSOAR's ability to manage user roles and permissions effectively, which could hinder system operations and user management.
NEW QUESTION # 22
Which statement about licensing on FortiSOAR is true? (Choose one answer)
- A. The evaluation license has an expiry date but no limit on user count.3
- B. The perpetual trial license has a limit on actions per day but no limit on user count.2
- C. A FortiSOAR VM with a perpetual license needs access to update.fortiguard.net.1
- D. The subscription license requires connectivity to globalupdate.fortinet.net to retrieve information.
Answer: D
Explanation:
Comprehensive and Detailed Explanation From FortiSOAR 7.3 Exact Extract study guide:
According to the FortiSOAR 7.3 Deployment and Administration Guide under the "Licensing FortiSOAR" section:
* Connectivity Requirements:For the FortiSOAR license deployment and validation process to succeed, the instance must have outbound connectivity tohttps://globalupdate.fortinet.net. This URL is specifically used by the FortiSOAR license manager to fetch entitlements, verify the subscription status, and retrieve product information from the Fortinet licensing servers. If this connectivity is blocked (and a FortiManager is not being used as a local FDN proxy), the license deployment will fail.4
* License Limits:Every FortiSOAR license-whether Perpetual, Subscription, or Trial-strictly enforces amaximum number of active users(concurrent or named) and often a limit on the number of automation actions per day.5
* Perpetual Trial Licenses(often called "Free Trial") are restricted to a specific user count (typically 2 or 3) and a daily action limit (e.g., 200 or 1000 actions). Therefore, options C and D are incorrect as they suggest "no limit on user count."
* URL Clarification:While update.fortiguard.net is a common Fortinet endpoint for security signatures (IPS/AV), FortiSOAR's specific licensing and entitlement communication is directed to the globalupdate.fortinet.netservice.
NEW QUESTION # 23
Which SMS vendor does FortiSOAR support for two-factor authentication?
- A. Telesign
- B. 2factor
- C. Google Authenticator
- D. Twilio
Answer: A
Explanation:
For two-factor authentication (2FA) via SMS, FortiSOAR supports integration with Telesign. This vendor provides SMS-based 2FA services, enabling FortiSOAR to leverage Telesign's API for sending verification codes as part of its security features. Telesign's service is compatible with FortiSOAR, ensuring secure user authentication when accessing the platform or certain features.
NEW QUESTION # 24
Refer to the exhibit.
How long after the syops-ha service goes down will the heartbeat missed notification be sent to the administrator?
- A. 5 minutes
- B. 60 minutes
- C. 3 minutes
- D. 15 minutes
Answer: B
Explanation:
In FortiSOAR's high availability (HA) setup, if the cyops-ha service becomes unresponsive, the system is configured to send a "heartbeat missed" notification after a specified period, which in this case is 60 minutes. This delay allows for transient issues to be resolved without triggering immediate alerts, while also ensuring that administrators are informed of prolonged service disruptions. Timely notifications about the cyops-ha service's status help maintain the reliability and responsiveness of the HA environment.
NEW QUESTION # 25
Refer to the exhibit.
How long after the syops-ha service goes down will the heartbeat missed notification be sent to the administrator?
- A. 5 minutes
- B. 60 minutes
- C. 3 minutes
- D. 15 minutes
Answer: B
Explanation:
In FortiSOAR's high availability (HA) setup, if the cyops-ha service becomes unresponsive, the system is configured to send a "heartbeat missed" notification after a specified period, which in this case is 60 minutes.
This delay allows for transient issues to be resolved without triggering immediate alerts, while also ensuring that administrators are informed of prolonged service disruptions. Timely notifications about the cyops-ha service's status help maintain the reliability and responsiveness of the HA environment.
NEW QUESTION # 26
Which service on FortiSOAR is the playbook scheduler?
- A. colcrybeatd
- B. uwsgi
- C. celeryd
- D. cyops-torccat
Answer: A
Explanation:
In FortiSOAR, the service responsible for the playbook scheduling functionality is colcrybeatd. This service manages the timing and execution of scheduled playbooks, allowing for the automation of various tasks at specified intervals. It ensures that playbooks execute according to their configured schedules, which can include tasks such as data ingestion, threat detection, or incident response actions. Proper functioning of this service is essential for the reliable automation of time-dependent processes within FortiSOAR.
NEW QUESTION # 27
Which three features are installed with the FortiSOAR Incidence Response Content Pack? (Choose three answers)
- A. Sample data for playbooks
- B. SLA template module
- C. System monitoring connectors1
- D. Sample alerts and incidents
- E. System playbooks2
Answer: A,D,E
Explanation:
Comprehensive and Detailed Explanation From FortiSOAR 7.3 Exact Extract study guide:
The FortiSOAR Incidence Response Content Pack (which is essentially the predecessor or foundational component of the SOAR Framework Solution Pack in version 7.3) is designed to provide users with an immediate, functional environment. According to the FortiSOAR 7.3 Administration Guide and Content Hub documentation:
* Sample Alerts and Incidents (C):The content pack includes a set of demo records.3Upon installation and clicking the "Demo IR Records" button, the system populates the Alerts and Incidents modules with pre-configured samples, including associated indicators and assets, to demonstrate how records are handled.4
* System Playbooks (D):It installs a comprehensive collection of "out-of-the-box" (OOB) playbooks.
These include system-level playbooks used for triaging, indicator extraction, and managing standard record lifecycles (such as auto-populating dates when a record is closed).5
* Sample Data for Playbooks (B):Along with the records themselves, the pack includes simulation and training data (often referred to as "Playbook Samples" or "Mock Data").6This allows administrators to test playbook logic and workflows without requiring live feeds from third-party security tools.
Why other options are incorrect:
* System monitoring connectors (A):While the pack may configure some basic internal connectors (like the Code Snippet connector), "system monitoring connectors" are generally standalone integrations or part of specific device solution packs rather than the core IR pack.
* SLA template module (E):Although the pack includesplaybooksthat manage SLAs (calculating response and resolution times), the "SLA Management" or "SLA Template" capability is often categorized as an additional module or handled via the Module Editor, rather than being a specific
"feature" installed solely by the IR pack.
NEW QUESTION # 28
What two permissions must you assign to a user to allow the purge of audit logs for all users? (Choose two answers)
- A. Delete permission on the Users module
- B. Delete permission on the People module
- C. Delete permission on the Security module
- D. Delete permission on the Audit Log Activities module
Answer: C,D
Explanation:
Comprehensive and Detailed Explanation From FortiSOAR 7.3 Exact Extract study guide:
According to the FortiSOAR 7.3 Administration Guide under the "Audit Logs" and "Role-Based Access Control (RBAC)" sections, managing the lifecycle of system logs requires elevated administrative privileges.
To perform a manual purge of audit logs, the system validates permissions across two specific areas:
* Audit Log Activities Module:The user must haveDeletepermissions on this specific module because it is the repository where the actual log records are stored. Without "Delete" rights here, the application cannot remove the database entries.
* Security Module:Because the purging of audit logs is a sensitive security operation that affects the system's accountability trail, FortiSOAR requires theDeletepermission on theSecuritymodule. This acts as a secondary administrative guardrail to ensure only authorized security administrators can permanently remove audit trails.
Permissions on thePeopleorUsersmodules (Options C and D) are used for managing user profiles and account attributes, but they do not grant the authority to manipulate system-level audit databases.
NEW QUESTION # 29
What are two use cases for configuring a FortiSOAR HA cluster?
(Choose two.)
- A. Data externalization
- B. Scaling
- C. Multi-tenancy
- D. Disaster recovery
Answer: B,D
NEW QUESTION # 30 
View the exhibit. The dataset on FortiSOAR has been trained to predict which record field?
- A. Severity
- B. Playbooks
- C. Status
- D. Assigned To
Answer: A
NEW QUESTION # 31
Several users have informed you that the FortiSOAR GUI Is not reachable. When troubleshooting, which step should you take first?
- A. Enter the csadm services --restart ngiax command to restart only the Nginx process.
- B. Review the connecters.log file to see what is happening to the HTTPS connections.
- C. Enter the csadm license --show-details command to check if there is a duplicate license.
- D. Enter the systemct1 status nginx command to gather more information.
Answer: D
Explanation:
When troubleshooting the issue of the FortiSOAR GUI not being reachable, the first step should be to check the status of the nginx service, which is responsible for managing web requests. Using the command systemctl status nginx will provide information on whether the service is running and any potential issues or errors related to it. This approach is more efficient as it directly addresses the service responsible for the web interface, making it possible to diagnose and resolve common issues such as service failure, configuration errors, or connectivity problems.
NEW QUESTION # 32
What are two features of the FortiSOAR perpetual trial license? (Choose two.).
- A. It provides access to FortiSOAR for a limited amount of time per day.
- B. It is a multi-tenant type license.
- C. It has restrictions on the number of actions that can be performed.
- D. It has restrictions on the number of users.
Answer: C,D
Explanation:
The FortiSOAR perpetual trial license includes limitations on both the number of users and the number of actions that can be performed. These restrictions are in place to provide prospective users with a functional evaluation of FortiSOAR while limiting its usage in a production environment. The trial license does not support multi-tenancy and restricts the overall capacity for scaling, making it suitable only for testing and familiarization with FortiSOAR's capabilities.
NEW QUESTION # 33
Which three roles are defined as SAML roles?
(Choose three.)
- A. Service provider
- B. Principal
- C. Role
- D. Attribute map
- E. Identity provider
Answer: A,B,E
NEW QUESTION # 34
Refer to the exhibit.
When importing modules to FortiSOAR using the configuration wizard, what actions are applied to fields it you select Merge with Existing as the Bulk action?
- A. Existing fields are kept, new fields are added, and non-imported fields are deleted.
- B. Existing fields are kept, new fields are added, and non-imported fields are kept.
- C. Existing fields are overwritten, new fields are added, and non-Imported fields are kept.
- D. Existing Holds are overwritten, now fields are added, and non-imported fields are deleted.
Answer: C
Explanation:
When importing modules into FortiSOAR using the configuration wizard and selecting "Merge with Existing" as the bulk action, the behavior for field handling is as follows: any fields that already exist in the system are overwritten with the imported values. New fields from the imported module are added to the system, while fields that are not part of the imported module remain unaffected and are retained in the system. This option ensures that existing data structures are updated with new information without losing existing, but non- imported, fields.
NEW QUESTION # 35
......
New NSE6_FSR-7.3 Exam Dumps with High Passing Rate: https://pass4sure.testvalid.com/NSE6_FSR-7.3-valid-exam-test.html