FCSS_SOC Question 30

Community Discussion

Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.

• Chose A0

  ,D - * Understanding the Playbook Configuration: * The playbook named "Update Asset and Identity Database" is designed to update the FortiAnalyzer Asset and Identity database with endpoint and user information. * The exhibit shows the playbook with three main components: ON_SCHEDULE STARTER, GET_ENDPOINTS, and UPDATE_ASSET_AND_IDENTITY. * Analyzing the Components: * ON_SCHEDULE STARTER:This component indicates that the playbook is triggered on a schedule, not on-demand. * GET_ENDPOINTS:This action retrieves information about endpoints, suggesting it interacts with an endpoint management system. * UPDATE_ASSET_AND_IDENTITY:This action updates the FortiAnalyzer Asset and Identity database with the retrieved information. * Evaluating the Options: * Option A:The actions shown in the playbook are standard local actions that can be executed by the FortiAnalyzer, indicating the use of a local connector. * Option B:There is no indication that the playbook uses a FortiMail connector, as the tasks involve endpoint and identity management, not email. * Option C:The playbook is using an "ON_SCHEDULE" trigger, which contradicts the description of an on-demand trigger. * Option D:The action "GET_ENDPOINTS" suggests integration with an endpoint management system, likely FortiClient EMS, which manages endpoints and retrieves information from them. * Conclusion: * The playbook is configured to use a local connector for its actions. * It interacts with FortiClient EMS to get endpoint information and update the FortiAnalyzer Asset and Identity database. References: * Fortinet Documentation on Playbook Actions and Connectors. * FortiAnalyzer and FortiClient EMS Integration Guides.