Fortinet NSE8_812 Exam - Topic 5 Question 30 Discussion

Actual exam question for Fortinet's NSE8_812 exam

Question #: 30
Topic #: 5

Refer to the exhibit showing a FortiSOAR playbook.

You are investigating a suspicious e-mail alert on FortiSOAR, and after reviewing the executed playbook, you can see that it requires intervention.

What should be your next step?

AGo to the Incident Response tasks dashboard and run the pending actions

BClick on the notification icon on FortiSOAR GUI and run the pending input action

CRun the Mark Drive by Download playbook action

DReply to the e-mail with the requested Playbook action

Show Suggested Answer

Suggested Answer: A

The exhibited playbook requires intervention, which means that the playbook has reached a point where it needs a human operator to take action. The next step should be to go to the Incident Response tasks dashboard and run the pending actions. This will allow you to see the pending actions that need to be taken and to take those actions.

The other options are not correct. Option B will only show you the notification icon, but it will not allow you to run the pending input action. Option C will run the Mark Drive by Download playbook action, but this is not the correct action to take in this case. Option D is not a valid option.

Here are some additional details about pending actions in FortiSOAR:

Pending actions are actions that need to be taken by a human operator.

Pending actions are displayed in the Incident Response tasks dashboard.

Pending actions can be run by clicking on the action in the dashboard.

by Pauline at Aug 23, 2024, 10:21 PM

Limited Time Offer

25%

Off

Get Premium NSE8_812 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Kanisha

3 months ago

Wait, can you really just reply to the email? That seems off!

upvoted 0 times

...

Solange

3 months ago

I disagree, replying to the email sounds like a bad idea.

upvoted 0 times

...

Glenna

3 months ago

Running the Mark Drive by Download playbook seems risky.

upvoted 0 times

...

Sherrell

4 months ago

I think clicking the notification icon is the way to go!

upvoted 0 times

...

Simona

4 months ago

Definitely go to the Incident Response tasks dashboard for pending actions.

upvoted 0 times

...

Melvin

4 months ago

I don't think replying to the email is the right approach. That seems off, but I can't recall what the exact next step should be.

upvoted 0 times

...

Raymon

4 months ago

I feel like we had a similar question in our practice exams. Running the Mark Drive by Download playbook action sounds familiar, but I’m not confident it’s the next step here.

upvoted 0 times

...

Lon

4 months ago

I'm not entirely sure, but I remember something about clicking the notification icon in FortiSOAR to handle pending actions. Could that be the right choice?

upvoted 0 times

...

Dianne

5 months ago

I think the next step might be to go to the Incident Response tasks dashboard and run the pending actions. That seems like a logical move based on what we practiced.

upvoted 0 times

...

Asha

5 months ago

I'm a little confused by the different options here. I'm not sure if I should be clicking on the notification icon or running a separate playbook action. I'll need to double-check the details to make sure I understand the right approach.

upvoted 0 times

...

Arlen

5 months ago

Okay, let's see. The playbook has executed, so I think the next logical step would be to go to the Incident Response tasks dashboard and run the pending actions. That seems like the most direct way to address the issue.

upvoted 0 times

...

Yen

5 months ago

Hmm, I'm a bit unsure about this one. The playbook seems to require intervention, but I'm not sure which of these options is the best way to handle it. I'll need to think this through carefully.

upvoted 0 times

...

Annice

5 months ago

This looks like a straightforward question about responding to a FortiSOAR playbook alert. I'll carefully review the options and think through the appropriate next steps.

upvoted 0 times

...

Brock

5 months ago

I think HTML5 supports all CSS standards, but I'm not completely sure if it includes CSS1.

upvoted 0 times

...

Veronique

5 months ago

I want to say the maximum is 300, but I keep mixing it up with other systems we've studied.

upvoted 0 times

...

Alethea

1 year ago

B) Click on the notification icon on FortiSOAR GUI and run the pending input action. Duh, it's right there in the question. Although, I do enjoy a good game of 'find the hidden action'.

upvoted 0 times

...

Amina

1 year ago

C) Run the Mark Drive by Download playbook action. Wait, is this some kind of secret spy mission? I'm in!

upvoted 0 times

Luis

1 year ago

D) Reply to the e-mail with the requested Playbook action

upvoted 0 times

...

Dewitt

1 year ago

C) Run the Mark Drive by Download playbook action. Sounds exciting!

upvoted 0 times

...

German

1 year ago

B) Click on the notification icon on FortiSOAR GUI and run the pending input action

upvoted 0 times

...

Solange

1 year ago

A) Go to the Incident Response tasks dashboard and run the pending actions

upvoted 0 times

...

Lavina

1 year ago

D) Reply to the e-mail with the requested Playbook action. I mean, who doesn't love a good old-fashioned email reply, right? It's like a digital love letter to the suspicious activity.

upvoted 0 times

Elmira

1 year ago

D) Reply to the e-mail with the requested Playbook action

upvoted 0 times

...

Paris

1 year ago

A) Go to the Incident Response tasks dashboard and run the pending actions

upvoted 0 times

...

Zona

1 year ago

B) Click on the notification icon on FortiSOAR GUI and run the pending input action

upvoted 0 times

...

Ruth

1 year ago

A) Go to the Incident Response tasks dashboard and run the pending actions

upvoted 0 times

...

Mammie

1 year ago

I think option C) Run the Mark Drive by Download playbook action could also be a valid next step, depending on the situation.

upvoted 0 times

...

Marci

1 year ago

A) Go to the Incident Response tasks dashboard and run the pending actions. Surely, this is the right way to handle the situation.

upvoted 0 times

Coral

1 year ago

Yes, that sounds like the best next step to take.

upvoted 0 times

...

Aja

1 year ago

I think we should go to the Incident Response tasks dashboard and run the pending actions.

upvoted 0 times

...

Louvenia

1 year ago

I would go with option B) Click on the notification icon on FortiSOAR GUI and run the pending input action.

upvoted 0 times

...

Ernest

1 year ago

I agree with Maddie, running the pending actions seems like the logical next step.

upvoted 0 times

...

Sheron

2 years ago

B) Click on the notification icon on FortiSOAR GUI and run the pending input action. This is the most logical next step to investigate the suspicious email alert.

upvoted 0 times