[2026年10月]更新のNSE6_FSR-7.3試験問題集、無料サンプル365日更新
まもなく無料セール終了！リアルNSE6_FSR-7.3のPDF解答使おう
Fortinet NSE6_FSR-7.3 認定試験の出題範囲：
| トピック | 出題範囲 |
|---|---|
| トピック 1 |
|
| トピック 2 |
|
| トピック 3 |
|
| トピック 4 |
|
| トピック 5 |
|
質問 # 21
What are three protocols that a Level 3 analyst must adhere to when developing a new SOC alert handling technique? (Choose three.)
- A. The analyst must update documentation to establish procedures for this type of incident.
- B. The analyst must be able to escalate alerts to incidents.
- C. The analyst must be able to assign roles to teams based on their requirements.
- D. The analyst must identify the compromised indicators.
- E. The analyst must build SIEM rules or SOAR playbooks so that such incidents can be identified and indicators can be enriched.
正解：A、D、E
解説：
Identifying compromised indicators is essential for determining the nature and scope of the alert and forming the basis for future detection.
Building SIEM rules or SOAR playbooks ensures that similar incidents can be automatically detected and indicators enriched for faster response.
Updating documentation establishes formal procedures for handling such incidents consistently in the future.
質問 # 22
Which CLI command is applicable to only FortiSOAR HA clusters with an internal PostgreSQL database?
- A. csadm ha takeover
- B. csadmin ha show-health --all-nodes
- C. csadm ha get-replication status
- D. csadm ha export-conf
正解：C
解説：
This command checks the PostgreSQL replication status, which is only relevant when the HA cluster uses the internal PostgreSQL database for replication between nodes.
質問 # 23
When configuring an HA cluster with an externalized PostgreSQL database, which two tiles on the database server need to be configured to trust all FortiSOAR nodes' incoming connections? (Choose two.)
- A. db_external_config.yml.
- B. pg_hba.conf
- C. db_config.yml
- D. postgreaq1.conf
正解：B、D
解説：
In a FortiSOAR High Availability (HA) cluster setup with an externalized PostgreSQL database, it is necessary to configure the database server to allow incoming connections from all FortiSOAR nodes. This configuration involves modifying the pg_hba.conf file to set up host-based authentication and control which IP addresses can connect. The postgresql.conf file must also be adjusted to enable listening on all necessary IP addresses, which is critical for FortiSOAR nodes to connect to the database server securely and reliably.
Together, these configurations ensure that all FortiSOAR nodes can access the database, facilitating effective HA functionality.
質問 # 24
A decision step checks if a reputation score is greater than 80. However, some IPs with a score of "90" are not passing the condition.
What is the MOST likely cause?
- A. The connector returned inconsistent data
- B. The playbook requires manual approval
- C. The threshold should be set to 100
- D. The score is being treated as a string instead of a number
正解：D
解説：
If the value is a string ("90"), the comparison may not behave as expected in numeric conditions.
Type mismatch is a classic tricky issue.
質問 # 25
Refer to the exhibit.
The former primary node was relegated to the secondary rote but is stuck in the Faulted state.
Which two steps must you take to restore operation in the high availability (HA) cluster? (Choose two.)
- A. On the node that is in the Faulted state, enter the csadm ha leave-cluster command.
- B. Perform a fire drill to test the database integrity of the node that is in the Faulted state.
- C. Restart the node that is in the Faulted state to trigger another election.
- D. Enter the csadm ha join-cluster command to have the node that is in the Faulted state rejoin the HA cluster as a secondary node.
正解：A、D
解説：
In a FortiSOAR HA cluster, if the former primary node is relegated to a secondary role but is stuck in a Faulted state, it indicates that the node has lost sync or faced a failure during a role change. To restore its functionality, first, you should remove it from the cluster using the csadm ha leave-cluster command. Once it has left the cluster, you can use the csadm ha join-cluster command to re-add the node as a secondary node. This process will allow it to sync back up with the cluster and resume its role as intended.
質問 # 26
Which two ports must be open between FortiSOAR HA nodes'* (Choose two.)
- A. Port 25
- B. Port 5432
- C. Port 9200
- D. Port 6380
正解：B、C
解説：
In a FortiSOAR HA configuration, certain ports must be open for communication between nodes.
Port 5432 is required for PostgreSQL database communication, which is essential for data replication between HA nodes. Port 9200 is used by Elasticsearch, which FortiSOAR leverages for indexing and search functions across the nodes. These ports must be accessible between nodes to ensure seamless operation and data consistency within the cluster.
質問 # 27
A playbook uses two connectors in sequence. The first connector occasionally fails due to API rate limits, causing the entire playbook to stop.
What is the BEST solution?
- A. Add error handling with retry logic or conditional branching
- B. Remove the first connector
- C. Increase the playbook timeout
- D. Run the playbook manually
正解：A
解説：
Proper design includes:
Retry mechanisms
Error handling branches
This ensures resilience against transient failures like API rate limits.
質問 # 28
Which CLI command will not work when the PostgreSQL database on FortiSOAR is externalized?
- A. csadm ha takeover
- B. csadm ha export-conf
- C. csada ha firedrill
- D. csadmin ha show-health -all-nodes
正解：C
解説：
When the PostgreSQL database is externalized in FortiSOAR, certain HA-related CLI commands become inapplicable. Specifically, the csada ha firedrill command, which is used to test the integrity of the HA cluster by simulating failures, is not applicable in scenarios where the database is managed outside FortiSOAR. Externalizing the database changes how FortiSOAR manages database connections, making some internal commands like firedrill redundant.
質問 # 29
What two permissions must you assign to a user to allow the purge of audit logs for all users? (Choose two answers)
- A. Delete permission on the Users module
- B. Delete permission on the Audit Log Activities module
- C. Delete permission on the Security module
- D. Delete permission on the People module
正解：B、C
解説：
Comprehensive and Detailed Explanation From FortiSOAR 7.3 Exact Extract study guide:
According to the FortiSOAR 7.3 Administration Guide under the "Audit Logs" and "Role-Based Access Control (RBAC)" sections, managing the lifecycle of system logs requires elevated administrative privileges.
To perform a manual purge of audit logs, the system validates permissions across two specific areas:
* Audit Log Activities Module:The user must haveDeletepermissions on this specific module because it is the repository where the actual log records are stored. Without "Delete" rights here, the application cannot remove the database entries.
* Security Module:Because the purging of audit logs is a sensitive security operation that affects the system's accountability trail, FortiSOAR requires theDeletepermission on theSecuritymodule. This acts as a secondary administrative guardrail to ensure only authorized security administrators can permanently remove audit trails.
Permissions on thePeopleorUsersmodules (Options C and D) are used for managing user profiles and account attributes, but they do not grant the authority to manipulate system-level audit databases.
質問 # 30
Which edition of license, when deployed, will serve as a primary node in a distributed deployment?
- A. MT_RegionalSOC
- B. MT
- C. MT_Tenant
- D. Enterprise
正解：B
質問 # 31
Which two system monitoring reports are available on the System Monitoring widget? (Choose two.)
- A. Service Status
- B. RAM Usage
- C. CPU Usage
- D. Playbook Health Status
正解：A、C
質問 # 32
Which service is used by FortiSOAR to allow GUI access?
- A. redis
- B. celerybeatd
- C. nginx
- D. cyops-tomcat
正解：C
解説：
FortiSOAR uses NGINX as the web server to handle HTTP/HTTPS requests and provide access to the GUI.
質問 # 33
Which log file contains logs related to search events, including Elasticsearch events such as Elasticsearch indexing?
- A. uwsgi.log
- B. falcon.log
- C. integrations.log
- D. notifier.log
正解：B
解説：
The falcon.log file records search-related activities and includes Elasticsearch operations such as indexing and query execution.
質問 # 34
What are two use cases for configuring a FortiSOAR HA cluster? (Choose two.)
- A. Multi-tenancy
- B. Disaster recovery
- C. Scaling
- D. Data externalization
正解：B、C
質問 # 35
What two permissions must you assign to a user to allow the purge of audit logs for all users?
(Choose two answers)
- A. Delete permission on the Users module
- B. Delete permission on the Audit Log Activities module
- C. Delete permission on the Security module
- D. Delete permission on the People module
正解：B、C
解説：
To perform a manual purge of audit logs, the system validates permissions across two specific areas:
Audit Log Activities Module: The user must have Delete permissions on this specific module because it is the repository where the actual log records are stored. Without "Delete" rights here, the application cannot remove the database entries.
Security Module: Because the purging of audit logs is a sensitive security operation that affects the system's accountability trail, FortiSOAR requires the Delete permission on the Security module. This acts as a secondary administrative guardrail to ensure only authorized security administrators can permanently remove audit trails.
質問 # 36
Which service on FortiSOAR is the playbook scheduler?
- A. colcrybeatd
- B. cyops-torccat
- C. celeryd
- D. uwsgi
正解：A
解説：
In FortiSOAR, the service responsible for the playbook scheduling functionality is colcrybeatd. This service manages the timing and execution of scheduled playbooks, allowing for the automation of various tasks at specified intervals. It ensures that playbooks execute according to their configured schedules, which can include tasks such as data ingestion, threat detection, or incident response actions. Proper functioning of this service is essential for the reliable automation of time-dependent processes within FortiSOAR.
質問 # 37
Refer to the exhibit.
View the exhibit. The dataset on FortiSOAR has been trained to predict which record field?
- A. Severity
- B. Playbooks
- C. Assigned To
- D. Status
正解：A
質問 # 38
An administrator wants to collect and review all FortiSOAR log tiles to troubleshoot an issue.
Which two methods can they use to accomplish this? (Choose two.)
- A. Enter the csacta services --status command, and then copy the output.
- B. Enter the caacta log --collect directory command.
- C. Download the logs from the GUI.
- D. Review the contents of /var/log/messages.
正解：B、C
解説：
Administrators can collect and review FortiSOAR logs for troubleshooting in two primary ways.
First, they can download logs directly from the GUI, which provides access to various logs through an intuitive interface. Secondly, using the command-line interface, the csacta log --collect command can be used to gather all logs within a specified directory, enabling more detailed offline analysis. Both methods offer comprehensive log collection to aid in diagnosing and resolving issues.
質問 # 39
A scheduled playbook runs every hour. However, analysts notice that some alerts are processed multiple times across different runs.
What is the BEST way to fix this?
- A. Increase the interval to once per day
- B. Implement state tracking or filtering to process only new/unprocessed alerts
- C. Restart the FortiSOAR service
- D. Disable scheduling and run manually
正解：B
解説：
Without state management, scheduled playbooks may reprocess the same data.
Best practice:
Track processed items (e.g., using flags, timestamps, or IDs)
Filter only new alerts
質問 # 40
Refer to the exhibit. Which statement correctly describes the user's login behavior?
- A. The user is sent to a waiting queue if there are named users logged in.
- B. The user can log in only if there are enough seats available.
- C. The user will always be able to draw from the concurrent pool and log in.
- D. The user has an active concurrent session that does not time out.
正解：B
解説：
In FortiSOAR, when a user is configured with "Concurrent" access type, their ability to log in depends on the availability of concurrent user seats. This means the user can only log in if there are available seats in the concurrent pool. If all seats are occupied, the user must wait until a seat becomes free. This configuration allows multiple users to share a pool of licenses, making it suitable for environments where not all users need constant access.
質問 # 41
Refer to the exhibit. When importing modules to FortiSOAR using the configuration wizard, what actions are applied to fields if you select Merge with Existing as the bulk action?
- A. Existing fields are kept, new fields are added, and non-imported fields are deleted.
- B. Existing fields are overwritten, new fields are added, and non-Imported fields are kept.
- C. Existing Holds are overwritten, now fields are added, and non-imported fields are deleted.
- D. Existing fields are kept, new fields are added, and non-imported fields are kept.
正解：B
解説：
When importing modules into FortiSOAR using the configuration wizard and selecting "Merge with Existing" as the bulk action, the behavior for field handling is as follows: any fields that already exist in the system are overwritten with the imported values. New fields from the imported module are added to the system, while fields that are not part of the imported module remain unaffected and are retained in the system. This option ensures that existing data structures are updated with new information without losing existing, but non-imported, fields.
質問 # 42
......
NSE6_FSR-7.3問題集あなたを合格させる認証試験：https://www.passtest.jp/Fortinet/NSE6_FSR-7.3-shiken.html
最新でリアルなFortinet NSE6_FSR-7.3試験問題集解答：https://drive.google.com/open?id=1kTYB9fwcBTIvIhG_iLn-zDbsbectvNyH