Fortinet NSE6_FSR-7.3 Exam Dumps

Comprehensive and Detailed Explanation From FortiSOAR 7.3 Exact Extract study guide:

According to the FortiSOAR 7.3 Administration and Deployment Guides, specifically in the 'Licensing FortiSOAR' and 'Security Management' sections:

Licensing Enforcement: FortiSOAR strictly enforces the number of active users based on the installed license. The license specifies the maximum number of active users allowed in the system at any given point in time.

User Status (Active vs. Inactive): When the number of active users reaches the limit defined by the license, any additional users created or imported will be set to an Inactive status by default. An administrator cannot change their status to 'Active' until an existing active user is deactivated or deleted, or the license is upgraded to support more users.

Locked Status (Option A): It is important to distinguish between 'Inactive' and 'Locked.' Users become temporarily locked out of FortiSOAR when they exceed the configured number of authentication attempts (defaulting to 5 times) within a specific period. A locked user profile will typically display a 'Locked' indicator or a checkbox to 'Unlock' rather than a simple 'Inactive' status.

Other Options: While an email ID is required for account creation, its validity does not automatically trigger an 'Inactive' status (Option B). Similarly, a required password reset (Option C) forces a password change upon login but does not disable the account.

When configuring the system proxy for FortiSOAR, it is essential to ensure connectivity to certain URLs to maintain system updates and licensing. For FortiSOAR, access to https://iepo.fortisoar.fortinet.com is required for incident enrichment and analysis, while https://globalupdate.fortinet.net is necessary for global updates to keep the system up-to-date with the latest threat information. These connections allow FortiSOAR to communicate with Fortinet's servers to fetch updated threat intelligence and system updates, which are critical for the operational effectiveness of FortiSOAR.

When the PostgreSQL database is externalized in FortiSOAR, certain HA-related CLI commands become inapplicable. Specifically, the csada ha firedrill command, which is used to test the integrity of the HA cluster by simulating failures, is not applicable in scenarios where the database is managed outside FortiSOAR. Externalizing the database changes how FortiSOAR manages database connections, making some internal commands like firedrill redundant.

In FortiSOAR, system-level logs that can be purged include both 'Audit logs' and 'Executed Playbook logs.' These types of logs can be configured to be purged periodically to free up storage space and ensure that unnecessary logs do not impact system performance. The application configuration allows administrators to schedule automatic purges, which can be especially useful in high-activity environments where log data accumulates quickly. Purging these logs helps maintain a cleaner and more efficient system.