Key details for this exam, checked against the published exam outline
Each question shows the correct answer and an explanation of why it is right
A security team is planning a FortiSOAR deployment where the primary SOC platform will be installed at headquarters, and remote branch offices with limited connectivity need to execute playbooks locally while still reporting back to the central instance. Which deployment component should be installed at the branch offices to meet this requirement?
In a multi-node/multi-tenant FortiSOAR architecture, SME (Secondary Management Environment) nodes are deployed at remote locations to run playbooks locally against local connectors/appliances when connectivity to the central node is limited, while still syncing data back to the central FortiSOAR instance. Agents are lightweight components used for specific connectivity to isolated networks but do not run the full playbook execution environment independently the way an SME does. Tenant nodes are used in MSSP multi-tenancy architectures to isolate customer data, not to solve branch connectivity for playbook execution. There is no component called a 'step-mode SME' - this distractor is fabricated.
An analyst is configuring role-based access in FortiSOAR for a mid-size SOC. Tier 1 analysts should only be able to view and update incident records assigned to their own team, while Tier 2 analysts need visibility into records across multiple Tier 1 teams. The SOC manager wants to avoid creating duplicate roles for every team combination.
Which combination of FortiSOAR access control features should be used to achieve this most efficiently?
FortiSOAR access control separates 'what a user can do' (roles/permissions) from 'what records a user can see' (teams and team hierarchy). By configuring Tier 1 teams as children of a Tier 2 parent team in the team hierarchy, Tier 2 analysts automatically inherit visibility into records owned by or shared with the Tier 1 teams beneath them, without needing separate roles per team. Relying only on ownership fields ignores the team hierarchy feature. Manual per-record sharing does not scale. View templates control UI layout, not record-level access.
A playbook developer is building a playbook step that needs to extract the value of the 'severity' key from a JSON response returned by a connector step, where the response is a list of dictionaries and the developer only wants the severity of the first item in the list. In the FortiSOAR Jinja/JSON query editor, which expression correctly retrieves this value?
In FortiSOAR Jinja templating, list indexing uses standard bracket notation such as data[0] to access the first element of a list, followed by dot notation to access a dictionary key within that element, e.g. data[0].severity. The other options use incorrect syntax: placing the index after the key name, using a non-existent 'first()' method, and using curly braces instead of square brackets for indexing, none of which are valid Jinja/Python-style access patterns supported in FortiSOAR.
During a phishing incident investigation, an analyst wants to visually see how an Alert record relates to an associated Indicator record, which in turn is linked to a MITRE ATT&CK Technique record used to enrich the incident. The analyst opens the incident record in FortiSOAR and wants a graphical view showing these interconnected records and their relationships rather than reading through individual record tabs.
Which FortiSOAR feature should the analyst use?
Visual Correlation in FortiSOAR provides a graphical node-and-edge representation of related records across modules (such as Alerts, Indicators, and MITRE ATT&CK Techniques), letting analysts quickly understand relationships and connections relevant to an incident. War Room is a collaborative workspace for incident handling but does not provide a relationship graph. Queue and shift dashboards manage workload assignment, not record relationships. Content Hub is used to browse and install connectors, playbooks, and solution packs, not for visualizing record relationships.
A playbook that previously ran successfully now fails intermittently at a connector step that queries FortiManager. The FortiSOAR administrator wants to inspect the exact input parameters sent to the connector and the raw output/error returned at the time of failure, without re-running the playbook in a test environment.
Which troubleshooting approach directly provides this information?
The Executed Playbooks page in FortiSOAR records each playbook run, and for a specific failed run, drilling into the failed step shows the evaluated input parameters actually sent and the output or error response received, which is the most direct way to diagnose an intermittent connector failure. Increasing the logging level can add more detail to system logs but does not by itself show step-specific evaluated input/output as clearly as the Executed Playbooks record; reviewing a YAML config file does not show runtime data. License status and Content Hub installation logs are unrelated to runtime execution failures of a specific step.
44 questions covering all exam domains, starting from $20
Exam domains verified against: Official Fortinet NSE6_FSR_AN-7.6 exam guide, last checked September 2026.
Learn FortiSOAR deployment models and understand the system architecture through interface navigation and the Content Hub. FortiSOAR differs from traditional SIEM in how it handles orchestration compared to pure automation alone.
Sample question from this domain above: Q1
Master how modules, records, fields and relationships work together to define the FortiSOAR data model including SME agents, tenant nodes and solution pack content. Picklist configuration and visual correlation are practical applications of these concepts.
Develop competency in implementing playbook logic using step conditions, loops and dynamic variables with Jinja filters. This is the largest objective area and requires hands-on familiarity with data flow, preprocessing rules and step utility actions.
Sample question from this domain above: Q3
Manage the FortiSOAR incident lifecycle including queue and shift assignment for workload distribution. Understand how war rooms support team collaboration and how MITRE ATT&CK Framework integration enables tactics and techniques mapping.
Configure FortiSOAR connectors using REST API and JSON-RPC methods alongside custom connector development. Learn how HTTP methods map to CRUD operations and how to interact with FortiSOAR programmatically.
Debug playbooks using executed playbook logs with proper logging levels and step input/output inspection. The Jinja editor is essential for troubleshooting expression evaluation in dynamic data manipulation.
Sample question from this domain above: Q5
Common questions about the exam itself
