A FortiSOAR playbook includes a Wait step that is configured to pause execution after initiating...

Exact Extract: “Use the Wait step to specify the time that the playbook should wait after a specific step before continuing with the remaining steps in the playbook. Alternatively, specify the conditions that must be met before the playbook continues. For example, investigation playbooks should wait for enrichment to finish before continuing with the subsequent steps.”

The correct answers are A and B . A Wait step can resume after a defined duration, so option A is valid. It can also resume when a condition is met, such as the indicator record being updated after the reputation lookup or enrichment process completes, so option B is also valid. Option C is not a Wait-step function; retrying failed actions at intervals belongs to step execution/error-handling behavior, not the Wait step’s purpose. Option D is also wrong because executing another playbook is handled by a separate reference/playbook execution step, not by the Wait step while it is paused. The guide separately identifies “Reference a Playbook” as the step used to execute another playbook.

Technical Deep Dive: In FortiSOAR playbooks, Wait is a control-flow gate. Use time-based waiting when an external system has predictable processing latency, for example waiting 60 seconds after submitting an IOC to a sandbox or reputation service. Use condition-based waiting when the downstream update is asynchronous, for example waiting until an indicator’s reputation, enrichment status, or related field changes. This prevents the playbook from reading incomplete enrichment data. This is SOAR workflow orchestration; FortiGate NP/CP hardware offloading is irrelevant because no traffic forwarding, session acceleration, or content processor inspection is involved.