NSE6_FSR-7.3 Fortinet NSE 6 - FortiSOAR 7.3 Administrator Questions and Answers

In FortiSOAR, appliance users are accounts that represent non-human entities, such as system processes or integrations. These users do not require login IDs and therefore do not contribute to the licensing user count. Appliance users are configured for backend tasks or to interact with external systems, enabling automated processes without consuming standard user licenses. This approach optimizes system resources and keeps licensing costs manageable​.

In FortiSOAR's high availability (HA) setup, if the cyops-ha service becomes unresponsive, the system is configured to send a "heartbeat missed" notification after a specified period, which in this case is 60 minutes. This delay allows for transient issues to be resolved without triggering immediate alerts, while also ensuring that administrators are informed of prolonged service disruptions. Timely notifications about the cyops-ha service's status help maintain the reliability and responsiveness of the HA environment​.

In a FortiSOAR HA configuration, certain ports must be open for communication between nodes. Port 5432 is required for PostgreSQL database communication, which is essential for data replication between HA nodes. Port 9200 is used by Elasticsearch, which FortiSOAR leverages for indexing and search functions across the nodes. These ports must be accessible between nodes to ensure seamless operation and data consistency within the cluster​.

Comprehensive and Detailed Explanation From FortiSOAR 7.3 Exact Extract study guide:

According to the FortiSOAR 7.3 Deployment and Administration Guide under the "Licensing FortiSOAR" section:

Connectivity Requirements:For the FortiSOAR license deployment and validation process to succeed, the instance must have outbound connectivity tohttps://globalupdate.fortinet.net. This URL is specifically used by the FortiSOAR license manager to fetch entitlements, verify the subscription status, and retrieve product information from the Fortinet licensing servers. If this connectivity is blocked (and a FortiManager is not being used as a local FDN proxy), the license deployment will fail.4

License Limits:Every FortiSOAR license—whether Perpetual, Subscription, or Trial—strictly enforces amaximum number of active users(concurrent or named) and often a limit on the number of automation actions per day.5

Perpetual Trial Licenses(often called "Free Trial") are restricted to a specific user count (typically 2 or 3) and a daily action limit (e.g., 200 or 1000 actions). Therefore, options C and D are incorrect as they suggest "no limit on user count."

URL Clarification:While update.fortiguard.net is a common Fortinet endpoint for security signatures (IPS/AV), FortiSOAR's specific licensing and entitlement communication is directed to theglobalupdate.fortinet.netservice.

When the PostgreSQL database is externalized in FortiSOAR, certain HA-related CLI commands become inapplicable. Specifically, the csada ha firedrill command, which is used to test the integrity of the HA cluster by simulating failures, is not applicable in scenarios where the database is managed outside FortiSOAR. Externalizing the database changes how FortiSOAR manages database connections, making some internal commands like firedrill redundant​.

In FortiSOAR, the service responsible for the playbook scheduling functionality is colcrybeatd. This service manages the timing and execution of scheduled playbooks, allowing for the automation of various tasks at specified intervals. It ensures that playbooks execute according to their configured schedules, which can include tasks such as data ingestion, threat detection, or incident response actions. Proper functioning of this service is essential for the reliable automation of time-dependent processes within FortiSOAR​.

The FortiSOAR queue and shift management feature enables several key activities for managing shifts and queues. Administrators can initiate shift handovers, allowing for smooth transitions between shift leads and members. They can also designate specific roles within shifts, including shift leads and members, to define responsibilities. Additionally, queue rules can be established based on certain conditions, ensuring that incidents and tasks are assigned according to predefined criteria, which helps streamline operations and improve response times​.