nerdexam
Fortinet

NSE7_SOC_AR-7.6 · Question #35

Refer to the exhibits. The Quarantine Endpoint by EMS playbook execution failed. What can you conclude from reviewing the playbook tasks and raw logs?

The correct answer is B. The endpoint is quarantined, but the action status is not attached to the incident. You've hit your limit · resets 5am (America/New_York)

FortiAnalyzer for SOC

Question

Refer to the exhibits. The Quarantine Endpoint by EMS playbook execution failed. What can you conclude from reviewing the playbook tasks and raw logs?

Exhibits

NSE7_SOC_AR-7.6 question #35 exhibit 1
NSE7_SOC_AR-7.6 question #35 exhibit 2

Options

  • AThe local connector is incorrectly configured, which is causing JSON API errors.
  • BThe endpoint is quarantined, but the action status is not attached to the incident.
  • CThe admin user does not have the necessary rights to update incidents.
  • DThe playbook executed in an ADOM where the incident does not exist.

How the community answered

(37 responses)
  • A
    3% (1)
  • B
    65% (24)
  • C
    22% (8)
  • D
    11% (4)

Explanation

You've hit your limit · resets 5am (America/New_York)

Topics

#playbook troubleshooting#endpoint quarantine#FortiClient EMS#incident attachment

Community Discussion

No community discussion yet for this question.

Full NSE7_SOC_AR-7.6 Practice