NSE6_FSR-7-3 Practice Questions

When importing modules into FortiSOAR using the configuration wizard and selecting "Merge with

Existing" as the bulk action, the behavior for field handling is as follows: any fields that already exist

in the system are overwritten with the imported values. New fields from the imported module are

added to the system, while fields that are not part of the imported module remain unaffected and

are retained in the system. This option ensures that existing data structures are updated with new

information without losing existing, but non-imported, fields​.

In FortiSOAR, appliance users are accounts that represent non-human entities, such as system

processes or integrations. These users do not require login IDs and therefore do not contribute to the

licensing user count. Appliance users are configured for backend tasks or to interact with external

systems, enabling automated processes without consuming standard user licenses. This approach

optimizes system resources and keeps licensing costs manageable​.

In a FortiSOAR HA configuration, certain ports must be open for communication between nodes. Port

5432 is required for PostgreSQL database communication, which is essential for data replication

between HA nodes. Port 9200 is used by Elasticsearch, which FortiSOAR leverages for indexing and

search functions across the nodes. These ports must be accessible between nodes to ensure

seamless operation and data consistency within the cluster​.

To audit and restrict a user’s access within FortiSOAR, particularly in response to unauthorized access

reports, it's necessary to review the user’s effective role permissions. This involves checking which

roles grant the user access to the System Configuration module and adjusting as needed.

Additionally, reviewing the user's team hierarchy ensures that the user’s access aligns with the

organization’s policies. Misconfigurations in team relationships can sometimes inadvertently provide

elevated access; hence, confirming that the team setup is correct is a critical part of the auditing

process​.

When joining a FortiSOAR cluster as a standby node, the correct status value should be passive. Using

active would imply that the node is trying to join as an active node, which could cause conflicts in the

cluster setup. In FortiSOAR, standby nodes must be set as passive to ensure they are recognized

correctly and to avoid conflicts with the primary node or other active nodes within the cluster.

Therefore, setting the status to passive will resolve the issue and allow the node to join the cluster as

intended​.

In FortiSOAR, when a user is configured with "Concurrent" access type, their ability to log in depends

on the availability of concurrent user seats. This means the user can only log in if there are available

seats in the concurrent pool. If all seats are occupied, the user must wait until a seat becomes free.

This configuration allows multiple users to share a pool of licenses, making it suitable for

environments where not all users need constant access​.

Elasticsearch in FortiSOAR is used for its robust data handling capabilities, allowing rapid storage,

searching, and analysis of vast amounts of data in near real-time. Its integration with FortiSOAR’s

global search enables efficient querying across all records, providing quick response times and a

seamless user experience. The Elasticsearch database is crucial for handling extensive datasets and

delivering swift search results, making it integral to FortiSOAR's performance and data management

capabilities​.

:

In FortiSOAR, system-level logs that can be purged include both "Audit logs" and "Executed Playbook

logs." These types of logs can be configured to be purged periodically to free up storage space and

ensure that unnecessary logs do not impact system performance. The application configuration

allows administrators to schedule automatic purges, which can be especially useful in high-activity

environments where log data accumulates quickly. Purging these logs helps maintain a cleaner and

more efficient system​.

When configuring the system proxy for FortiSOAR, it is essential to ensure connectivity to certain

URLs to maintain system updates and licensing. For FortiSOAR, access to

https://iepo.fortisoar.fortinet.com is required for incident enrichment and analysis, while

https://globalupdate.fortinet.net is necessary for global updates to keep the system up-to-date with

the latest threat information. These connections allow FortiSOAR to communicate with Fortinet's

servers to fetch updated threat intelligence and system updates, which are critical for the operational

effectiveness of FortiSOAR​.