Automation Stitch Components: Trigger, Action, Conditions
A FortiGate administrator wants to use FortiManager automation stitches to automatically block an IP address when a specific threat is detected. Which components must be configured within the automation stitch?
Quick Answer
The correct answer is a trigger, at least one action, and optionally conditions. This structure is mandatory because the trigger defines the specific event—such as a log match for a detected threat—that initiates the automation stitch, while the action executes the response, like running a CLI script to block an IP address via firewall address creation. Conditions are optional but provide critical filtering to ensure the stitch only fires under precise circumstances, preventing it from triggering on every occurrence of the event. On the Fortinet NSE 7 Advanced Security NSE7 exam, this concept tests your understanding of how automation stitches enforce policy-driven responses in FortiManager, often appearing in scenario-based questions where a trap is to forget that conditions are not required but highly recommended for granular control. A useful memory tip is “TAC”: Trigger, Action, and optionally Conditions—just remember that the action is the only mandatory component beyond the trigger.
⚠ Common exam trap
Many exam-takers assume the trigger is implicit or predefined (like a schedule) and only an action is needed, but FortiManager requires explicit trigger configuration even for event-based automation, and conditions are optional but often necessary to avoid false positives.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
A trigger, at least one action, and optionally conditions
An automation stitch in FortiManager requires a trigger (e.g., an event or log match) to start the workflow, at least one action (e.g., a CLI script to block an IP via firewall address creation), and optionally conditions to filter when the trigger fires. This three-part structure is mandatory because the trigger defines the event, the action executes the response, and conditions provide granular control without which the stitch would fire on every trigger occurrence.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
A trigger and a connector to an external threat feed
Why it's wrong here
Connector is not required; action is needed.
- ✗
An action only, since the trigger is predefined
Why it's wrong here
Both trigger and action are required.
- ✓
A trigger, at least one action, and optionally conditions
Why this is correct
Trigger defines when to run; action defines what to do; conditions filter.
- ✗
A schedule and a script
Why it's wrong here
Schedule is not part of automation stitch.
Go deeper
Related to this question
About these practice questions
This NSE7 question is part of Courseiva's 940-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
4 more ways this is tested on NSE7
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A FortiGate administrator wants to use FortiManager automation stitches to automatically block IP addresses that trigger multiple intrusion prevention events. Which two components are required to configure an automation stitch? (Choose two.)
medium- ✓ A.Trigger
- B.Playbook
- C.Destination
- D.Schedule
- ✓ E.Action
Why A: An automation stitch in FortiManager requires a Trigger to define the event that initiates the stitch (e.g., an intrusion prevention event) and an Action to specify the response (e.g., blocking an IP address via a firewall address object). The Trigger monitors for specific log messages or system events, while the Action executes the configured remediation step. Without both, the stitch cannot be created or function.
Variation 2. A FortiGate administrator is setting up automation stitches in FortiManager to remediate threats. The stitch should run a CLI script on a managed FortiGate when a specific event is logged. Which THREE components must be configured in the automation stitch?
medium- ✓ A.Trigger
- B.Schedule
- ✓ C.Conditions
- D.Recovery action
- ✓ E.Action (CLI script)
Why A: An automation stitch in FortiManager requires a trigger to define the event that initiates the stitch. Without a trigger, the stitch has no starting condition and cannot execute. The trigger specifies the log event that, when matched, causes the stitch to run.
Variation 3. A FortiGate administrator uses FortiManager automation stitches to respond to a security incident. Which THREE components must be defined in an automation stitch? (Choose THREE.)
hard- ✓ A.Trigger condition (e.g., an event or log)
- B.A report template
- C.A schedule for the stitch to run
- ✓ D.Target devices (e.g., specific FortiGates)
- ✓ E.Action (e.g., execute a CLI command, send email)
Why A: An automation stitch in FortiManager requires a trigger condition to define when the stitch should be activated. The trigger can be based on specific events, such as a log matching a predefined pattern or a FortiGate incident, which initiates the automated response workflow.
Variation 4. A FortiManager administrator wants to use automation stitches to respond to a specific security event on managed FortiGates. Which THREE components are required to build an automation stitch? (Select THREE.)
hard- ✓ A.Trigger
- ✓ B.Route
- ✓ C.Action
- D.FortiView dashboard
- E.ADOM
Why A: An automation stitch in FortiManager requires three core components: a Trigger (the event that starts the stitch), a Route (a conditional path that determines which actions to execute based on the trigger's output), and an Action (the actual response, such as a CLI script or object change). Without these three, the stitch cannot function as a complete automation workflow.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE7 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE7 exam.