Free NSE6_FSR_AN-7-6 Practice Test Questions and Answers (2026)

In FortiSOAR, when designing the data model and configuring relationships between modules via the Module Editor, administrators can define the hierarchical nature of how records interact. The platform explicitly supports configuring "Parents" (Parent-Child) and "Siblings" (Peer/Sibling) relationship types. These configurations establish the structural hierarchy of records within the system. For example, a major Incident can be configured as a parent to multiple child Alerts, while those individual Alerts can be configured to act as siblings to one another. This explicitly defined hierarchy directly influences how related records are linked, how data is inherited across modules, and how the relationships are visually represented within the FortiSOAR Visualizer and Link Graph widgets for analysts.

B. Grandparents: FortiSOAR does not feature a configurable "Grandparents" relationship type; multi-level hierarchies are built by chaining Parent-Child relationships rather than explicitly defining a grandparent.

D. Relatives: "Relatives" is not a recognized or configurable relationship type within the FortiSOAR Module Editor or data modeling schema.

Fortinet, Inc. (2024). FortiSOAR 7.6.0 Administration Guide. Section: Application Editor -> Configuring Relationships (Module Editor).

Fortinet, Inc. (2024). FortiSOAR 7.6.0 User Guide. Section: Dashboards and Widgets -> Visualizer Widget and Record Hierarchy.

FortiSOAR integrates Elasticsearch to power its Global Search functionality, enabling rapid, efficient, and comprehensive searches across all modules and records within the system. As a highly scalable open-source search and analytics engine, Elasticsearch is specifically designed to store, search, and analyze massive volumes of data in near real-time, typically returning complex query results in mere milliseconds. This native integration ensures that security analysts can quickly retrieve critical incident data, threat indicators, and alerts without experiencing performance degradation. Leveraging Elasticsearch for global search is essential for effective security orchestration, automation, and response (SOAR) operations, as it allows teams to correlate historical data and active threats instantaneously across the entire FortiSOAR database.

B. FortiSOAR does not use a falcon.conf file. Externalizing Elasticsearch is properly configured using the csadm db command-line utility or by modifying FortiSOAR's specific database configuration files.

C. The external Elasticsearch cluster version must exactly match the Elasticsearch version installed on your specific FortiSOAR instance (e.g., version 7.17.x for FortiSOAR 7.6), rather than a static 6.0.2 minimum.

1. Fortinet Document Library. FortiSOAR 7.6.0 Administration Guide. Section: "Global Search" (Details the use of Elasticsearch for rapid, system-wide record querying).

2. Fortinet Document Library. FortiSOAR 7.6.0 Deployment Guide. Section: "Externalizing Elasticsearch" (Specifies the requirement for exact version matching between the internal and external Elasticsearch clusters and details the csadm configuration steps).

In FortiSOAR 7.6, the System Monitoring widget is designed to provide administrators with real-time visibility into the underlying hardware and virtual appliance resource utilization. When configuring or viewing the System Monitoring widget on a dashboard, the available system monitoring reports specifically include hardware-centric metrics such as CPU Usage, RAM Usage, and Disk Usage. These metrics allow administrators to track performance bottlenecks and ensure the FortiSOAR instance has adequate resources to handle automated playbooks and incident response tasks. Service statuses and playbook-specific metrics are handled by distinct, dedicated widgets or system health pages rather than the hardware-focused System Monitoring widget.

C. Service Status: This is monitored via the System Health dashboard or specific service management interfaces, not the hardware-focused System Monitoring widget.

D. Playbook Health Status: Playbook execution and health are tracked using dedicated Playbook widgets (e.g., Playbook Execution History) rather than system resource monitors.

Fortinet, Inc. (2024). FortiSOAR 7.6.0 User Guide. Document ID: 10-760-000000-20240501. Section: Dashboards and Widgets > System Monitoring Widget.

Fortinet, Inc. (2024). FortiSOAR 7.6.0 Administration Guide. Document ID: 10-760-000000-20240501. Section: System Configuration > System Health and Monitoring.

FortiSOAR utilizes a comprehensive Role-Based Access Control (RBAC) model combined with team-based record ownership to enforce granular security. To meet the scenario's requirements, administrators must create distinct custom roles for junior and senior analysts, defining specific module-level permissions (e.g., Read, Update) for each. Furthermore, FortiSOAR's team hierarchy and record-level ownership mechanisms must be implemented to restrict data access. By assigning records to specific users or teams, and configuring role permissions to respect these ownership boundaries (e.g., allowing junior analysts access only to "Mine" or user-owned records, and senior analysts to "Team" records), the system ensures analysts cannot access unauthorized data across different teams while maintaining appropriate operational workflows.

B: Dashboard filters only alter UI visibility and do not enforce backend security; users could still access restricted records via API or global search.

C: FortiSOAR's security model relies on Roles and Teams for scalable access control; user-level permissions alone cannot enforce complex hierarchical and ownership-based restrictions.

D: Menu navigation restrictions merely hide UI elements. Without module-level RBAC permissions, users can still access unauthorized data via direct URLs or API calls.

1. Fortinet, Inc. (2024). FortiSOAR 7.6.0 Administration Guide. Section: "Security Management" -> "Role-Based Access Control (RBAC)". This section details how custom roles define module-level permissions (Create, Read, Update, Delete) based on ownership (Mine, Team, All).

2. Fortinet, Inc. (2024). FortiSOAR 7.6.0 Administration Guide. Section: "Security Management" -> "Teams and Users". This section explains how team hierarchies and record-level ownership prevent unauthorized access across different operational groups.

In a FortiSOAR High Availability (HA) cluster, the system relies on periodic heartbeats to monitor the health and reachability of cluster nodes. The provided exhibit explicitly defines the "Monitoring Interval" as 5 minutes and the "Missed Heartbeat Count" threshold as 3. The alert generation logic calculates the total failure detection time by multiplying the configured monitoring interval by the designated missed heartbeat count. Consequently, if the syops-ha service goes down, the monitoring job will detect the absence of the service across three consecutive 5-minute intervals. Multiplying the 5-minute interval by the 3 missed heartbeats yields a total duration of 15 minutes before the system officially determines a failure state and dispatches the heartbeat missed notification email to the administrator.

B. 60 minutes: This value is arbitrarily large and does not mathematically align with the 5-minute monitoring interval multiplied by the 3 missed heartbeat count threshold configured.

C. 5 minutes: This represents only a single monitoring interval, ignoring the explicit configuration requirement for three consecutive missed heartbeats to trigger the cluster health notification.

D. 3 minutes: This incorrectly interprets the "Missed Heartbeat Count" threshold value as a time duration in minutes rather than an absolute multiplier for the monitoring interval.

Fortinet, "FortiSOAR 7.4.x Administration Guide," High Availability Configuration: Cluster Health Monitoring, Document ID: FT-SOAR-7.4-Admin, Section: HA Monitoring and Notifications.

Fortinet, "NSE 6 FortiSOAR Architecture and High Availability," Official Training Courseware, Module 4: High Availability Operations and Health Checks.

In FortiSOAR 7.6, the Queue and Shift Management solution is specifically designed to streamline Security Operations Center (SOC) workflows. It allows administrators to configure specific shifts and assign personnel by generating designated "Shift Leads" and "Shift Members" to ensure clear hierarchies and operational responsibilities. Additionally, analysts can initiate shift handovers to seamlessly transfer ongoing investigations, pending tasks, and critical notes to the incoming shift, thereby preventing any operational gaps. Finally, the module enables the creation of queue rules based on matching conditions (Queue Routing Rules). These rules automatically triage and route incoming records, such as alerts or incidents, to the appropriate queues based on predefined criteria.

B. Designate a coordinator to monitor queues and shifts: FortiSOAR uses Shift Leads and Shift Members for role assignment within shifts; there is no specific "coordinator" designation feature built into this module.

D. Set up queue meeting rooms: FortiSOAR utilizes "War Rooms" for collaborative incident response and crisis management, which is an entirely separate feature from the Queue and Shift Management module.

Fortinet, Inc. (2024). FortiSOAR 7.6.0 User Guide. Chapter: Queue and Shift Management. Section: "Configuring Shifts" (Details the creation of Shift Leads and Shift Members).

Fortinet, Inc. (2024). FortiSOAR 7.6.0 User Guide. Chapter: Queue and Shift Management. Section: "Shift Handovers" (Details the process of initiating and managing shift handovers).

Fortinet, Inc. (2024). FortiSOAR 7.6.0 User Guide. Chapter: Queue and Shift Management. Section: "Queue Routing Rules" (Details creating rules based on matching conditions to route records).

When the FortiSOAR GUI becomes unreachable, the issue is most commonly related to the web server service that hosts the interface. FortiSOAR utilizes Nginx as its primary web server. According to standard troubleshooting methodologies and Fortinet guidelines, the first step is always to gather information about the current state of the system before attempting any remediation. Executing the systemctl status nginx command allows administrators to verify whether the Nginx service is active, inactive, or in a failed state. This provides immediate diagnostic clues, such as configuration errors or service crashes, without destroying volatile state data, which would happen if the service were prematurely restarted.

A. A duplicate or invalid license typically redirects users to a license upload page or restricts features, rather than making the entire web GUI completely unreachable at the network level.

B. Blindly restarting the Nginx service destroys current state information and volatile memory, violating the fundamental troubleshooting best practice of gathering diagnostic data first.

D. The connectors.log file records activities, execution traces, and errors specifically related to integration connectors, not the primary inbound HTTPS connections for the FortiSOAR web GUI.

1. Fortinet, Inc. (2024). FortiSOAR 7.6.0 Administration Guide. Section: "Troubleshooting FortiSOAR" -> "Service Management and Diagnostics" (Details standard Linux systemctl usage for core services like Nginx and PostgreSQL).

2. Fortinet, Inc. (2024). FortiSOAR 7.6.0 Deployment Guide. Section: "System Requirements and Core Services" (Identifies Nginx as the primary web server handling GUI access).

3. Fortinet, Inc. (2024). FortiSOAR 7.6.0 Log Management and Troubleshooting Reference. Section: "Log Files Overview" (Specifies connectors.log purpose versus /var/log/nginx/ for GUI access logs).

In FortiSOAR, Jinja2 templating is the standard method for handling dynamic data within playbooks. To efficiently process a list of multiple indicators without writing redundant code, you must use a Jinja for loop to iterate through the array of indicators returned by the malware analysis platform. Within this loop, Jinja filters are applied to parse, extract, and format the specific fields required for each record. Furthermore, assigning this extracted data to dynamic variables allows you to implement conditional logic (if/elif/else) inside the loop. This logic evaluates the indicator type (IP, domain, or hash) and dynamically determines the appropriate FortiSOAR module for record creation. This approach maximizes code reuse, ensures scalability, and adheres to FortiSOAR playbook optimization best practices.

B: Creating separate playbooks and manually executing them defeats the purpose of Security Orchestration, Automation, and Response (SOAR) by introducing manual overhead and failing to optimize the workflow.

C: Using only conditional statements without loops prevents the playbook from dynamically iterating through an array of unknown length, requiring hardcoded indices which is highly inefficient and unscalable.

D: Hardcoding actions directly into playbook steps without loops or variables creates massive redundancy, makes the playbook rigid, and completely fails the requirement to avoid redundant code.

1. Fortinet, Inc. (2024). FortiSOAR 7.6.0 Playbooks Guide. Chapter: "Building Playbooks", Section: "Using Jinja to add dynamic values". This section details the use of Jinja2 templates, filters, and dynamic variables for data manipulation.

2. Fortinet, Inc. (2024). FortiSOAR 7.6.0 Playbooks Guide. Chapter: "Advanced Playbook Concepts", Section: "Looping in Playbook Steps". This section explains how to iterate over arrays (like a list of indicators) to perform repetitive actions efficiently without duplicating playbook steps.

FortiSOAR provides a set of out-of-the-box default roles designed to align with standard Security Operations Center (SOC) responsibilities and system requirements. These pre-configured roles facilitate quick deployment and standard privilege assignment without requiring administrators to build a permission model from scratch. The default roles included in FortiSOAR are Application Administrator, Security Administrator, Playbook Administrator, SOC Manager, T1 Analyst, T2 Analyst, and FortiSOAR Agent.

The 'T1 Analyst' role is designed for frontline security personnel handling initial alert triage and basic incident response. The 'FortiSOAR Agent' role is a specialized system role utilized by the FortiSOAR agent appliance to securely communicate and execute actions across segmented networks. While administrators can create custom roles, T1 Analyst and FortiSOAR Agent are present by default upon initial installation.

B. T3 Analyst: FortiSOAR only includes T1 Analyst and T2 Analyst as default analyst roles; a T3 Analyst role must be manually created by an administrator if required.

D. Connector Administrator: This is not a default role in FortiSOAR. Connector management privileges are typically included in the default Application Administrator role or assigned via custom roles.

Fortinet Document Library: FortiSOAR 7.6.0 Administration Guide, Chapter: "Security Management", Section: "Roles" (Details the complete list of out-of-the-box default roles, explicitly listing T1 Analyst, T2 Analyst, and FortiSOAR Agent).

Fortinet Document Library: FortiSOAR 7.6.0 FSR Agent Guide, Chapter: "Introduction", Section: "Prerequisites" (Describes the usage of the default FortiSOAR Agent role for appliance communication).

In FortiSOAR, permanently deleting user accounts is performed via a backend script to ensure all associated database references are handled correctly. To execute this, administrators must enter the specific user IDs of the accounts they wish to remove into a designated text file named usersToDelete.txt. Once the user IDs are populated in this file, the administrator runs the associated deletion script provided in the FortiSOAR backend from the command line interface. This process ensures that the system safely removes the user records from the PostgreSQL database without causing referential integrity issues within the SOAR platform. Deleting users directly from the UI is generally restricted to deactivation; permanent deletion requires this specific file-based CLI method.

A. userDelete.txt: This is an incorrect filename; the official FortiSOAR utility specifically requires the pluralized filename usersToDelete.txt to process the deletion.

B. configyml: This file is used for general system and application configuration settings, not for specifying individual user IDs targeted for deletion.

C. scripts: This refers to a directory or a general category of executable files, rather than the specific text file where user IDs must be entered.

Fortinet, "FortiSOAR 7.6.0 Administration Guide," Chapter: Security Management, Section: Users (Sub-section: Deleting users). Document ID: FSA-7.6.0-Admin-Guide.