Exact Extract: “FortiSOAR incident handling phases are closely aligned with NIST incident handling phases… The Post-Incident Activity phase is renamed Aftermath. Functionally, they are identical.”
Exact Extract: “Use the Update Record step to update a record in a module within FortiSOAR. Use the Find Record step to find a record in a module within FortiSOAR.”
Exact Extract: “Use the Manual Task step to pause the playbook’s execution until you mark the task as skipped or completed.”
The correct answers are C, D, and E . The workflow must start when an existing incident is changed to the Aftermath phase, so the correct trigger is an On Update trigger with a condition that matches the incident phase. After the trigger fires, the incident already exists as the current playbook record, so a Find Record step is unnecessary. To set the incident status to Resolved and assign the purple team specialist as the incident lead, use an Update Record step. To create and assign the follow-up work item, use a Manual Task step assigned to the same specialist.
Option B is wrong because a Condition/Decision step evaluates logic; it does not assign records or create work. Option A is wrong because the playbook is already triggered by the updated incident record, so searching for matching incidents adds unnecessary complexity.
Technical Deep Dive: The clean playbook structure is: On Update trigger → Update Record → Manual Task. The trigger condition should check the incident phase field for Aftermath. The Update Record step should modify the current incident, setting fields such as Status = Resolved and Incident Lead = purple team specialist. The Manual Task step then creates analyst-visible work, such as “Write incident report,” assigned to that same user. This is FortiSOAR workflow automation; FortiGate NP/CP hardware offloading is irrelevant because there is no traffic-forwarding path involved.
