View all questions & answers for the NSE 7 - Security Operations 7.6 Architect Materials exam


Question 18 Discussion

Using the default data ingestion wizard in FortiSOAR, place the incident handling workflow from FortiSIEM to FortiSOAR in the correct sequence. Select each workflow component in the left column, hold and drag it to a blank position in the column on the right. Place the four correct workflow components in order, placing the first step in the first position at the top of the column. Once you place a workflow component, you can move it again if you want to change your answer before moving to the next question. You need to drop four workflow components in the work area. Select and drag the screen divider to change the viewable area of the source and work areas. (Choose four answers)

  • A. Step 1: FortiSIEM event log
  • B. Step 2: FortiSIEM Incident
  • C. Step 3: FortiSOAR alert
  • D. Step 4: FortiSOAR Incident
Correct Answer: A,B,C,D

Brave-Dump Clients Votes

ABCD 66.67%
D 33.33%

Comments



Brave-Dumps Admin 2025-10-29 15:16:37

Selected Answers: A, B, C, D


This is a drag-and-drop question, so the answer options should not be available. Please check the correct answers inside the question rectangle instead.


Wellknown 2025-11-04 17:03:40

Selected Answers: D


FortiSIEM event log --> FortiSIEM Incident --> FortiSOAR alert --> FortiSOAR Incident


Simon Cliffe 2026-02-06 15:03:13

Selected Answers: A, B, C, D


Raw events > Correlated to an incident > SOAR alert > converts to Incident for Investigation