NSE7 Enterprise Firewall and VDOMs Practice Question
An organization uses FortiAnalyzer for centralized logging. The security team wants to use playbooks to automate responses to detected incidents. Which THREE components are essential for a playbook to function?
⚠ Common exam trap
Test-takers frequently confuse 'report schedule' or 'dashboard visualization' as necessary components because they are common FortiAnalyzer features, but they are not part of the core playbook execution triad of trigger, conditions, and actions.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Trigger
In FortiAnalyzer playbooks, the essential building blocks are the trigger, conditions, and actions. Option A (Trigger) is correct because a playbook must have an event source that initiates execution, such as a new log, incident, or event detected by FortiAnalyzer. Option C (Conditions) is correct because conditions define the matching logic or filters that determine whether the playbook should run and which path it follows. Option E (Actions) is correct because actions specify the automated response steps the playbook performs, such as sending notifications, running CLI scripts, or creating incidents. Option B (A report schedule) is not required, since reports are separate scheduled outputs and do not drive playbook execution. Option D (A dashboard visualization) is not required, because dashboards are for display and monitoring, not for the functional logic of a playbook.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Trigger
Why this is correct
A playbook needs a trigger to initiate execution when a matching event or incident is detected. Without this starting condition, no automated response tasks can run, making the trigger an essential component of playbook functionality.
- ✗
A report schedule
Why it's wrong here
A report schedule generates periodic PDF or email reports and has no role in playbook execution. Playbooks require a trigger, an action or task, and connectors or a fabric device to act on; scheduling belongs to reporting workflows, not automated incident response.
- ✓
Conditions
Why this is correct
Conditions define the trigger logic that evaluates incoming logs and events, determining when a playbook executes and which branch it follows. Without them, automation cannot distinguish a genuine incident from routine traffic, so the playbook would either fire indiscriminately or never activate, defeating the response requirement in the stem.
- ✗
A dashboard visualization
Why it's wrong here
A dashboard visualisation only displays collected data and cannot trigger or execute playbook tasks. Playbooks need a trigger, an action, and connectors or fabric devices. Dashboards serve monitoring and reporting, which is a separate FortiAnalyzer function from automated response.
- ✓
Actions
Why this is correct
Actions define the executable steps a playbook runs against the triggering incident, such as blocking an IP or quarantining a host. Without at least one action, the playbook has no response mechanism, so it cannot satisfy the stem's requirement to automate responses to detected incidents.
Go deeper
Related to this question
About these practice questions
This NSE7 question is part of Courseiva's 718-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE7 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE7 exam.