NSE6-FSR-7-3 Fortinet NSE 6 - FortiSOAR 7.3 Administrator Practice Questions

This solution correctly uses the Teams and Team Hierarchy feature. Creating a parent/child structure allows the NA L2 team, when assigned to the Parent SOC, to view incidents in child teams (EU, APAC). Creating a separate, isolated team for Threat Intel achieves the required separation for playbook development. A global CISO role assigned at the parent level provides the necessary cross-region visibility. Full multi-tenancy is too rigid and doesn't allow for the required cross-team visibility for the NA L2 and CISO roles. Using only roles without teams cannot enforce the regional data segregation.

The top command is a standard Linux utility that provides a dynamic, real-time view of a running system's processes. It can be sorted by various metrics, including CPU usage (which it is by default), making it the ideal tool for identifying which specific process is causing high CPU load. csadm services --status shows if services are running, not their resource usage. df -h shows disk space. netstat shows network connections.

The standard and recommended procedure for managing the FortiSOAR license is through the graphical user interface. The License Manager page under the Settings module provides a simple interface to upload a new license file and view the current license status.

The War Room is a collaborative investigation hub. From within it, analysts can execute connector commands (e.g., query a SIEM), tag the results as evidence to link them to the incident timeline, and communicate with other team members in real-time. Modifying RBAC is an administrative function done outside the War Room. Creating new connectors is also an admin task.

Role definitions, which control what actions users can perform, are managed in the Security > Roles module. Here, an administrator can create a new role and granularly define its permissions for each module (e.g., granting Read and Update for Incidents but not Delete), and also explicitly deny permissions for Playbook execution.

The curl command is the most effective and standard Linux utility for testing network connectivity through a proxy from the command line. It allows specifying proxy credentials and the destination URL, providing a direct way to confirm if the FortiSOAR appliance can reach the external service through the configured proxy, independent of the connector's specific implementation. csadm proxy --test is not a valid command. ping does not support proxy settings. systemctl status secure-gateway checks the service status, not connectivity through it.

To meet the requirements, Teams must be used to segregate incidents by region, ensuring L1 analysts can only view records assigned to their team. Field-Level Permissions are then applied to the L1 analyst role to hide or make read-only specific sensitive fields like PII. System Fixtures are for system-wide settings, and Playbook Permissions control who can execute or modify playbooks, neither of which directly address the specified record and field visibility requirements.

In FortiSOAR, the 'Owner' of a record implicitly gets full CRUD (Create, Read, Update, Delete) permissions on that specific record, which overrides the standard team and role-based permissions. If a senior analyst accidentally assigned ownership of the high-severity incident to the junior analyst, it would grant them the unintended access described. The other options are less likely to grant full modification rights that bypass team restrictions.

The correct and safest procedure is to first create a backup or VM snapshot to allow for rollback. Then, the upgrade package must be downloaded and extracted (typically in /tmp). Finally, the upgrade.sh script is executed to perform the upgrade. This sequence ensures a recovery point exists before any system changes are made.

This statement is true. In a standard FortiSOAR active-passive HA cluster, all data, configurations, and playbooks are replicated to the passive node, but active processing and playbook execution only occur on the active node. If a failover occurs, the passive node becomes active and takes over these responsibilities.