Exact Extract: “This playbook also expects input from the user, specifically an IP address… you can manually type in an IP address. The trigger input is saved as ipAddress, which you can refer to later as a dynamic value.”

Exact Extract: “The connector must first be configured… The selected action is Get IP Reputation… The Get IP Reputation action requires input. In the trigger step, you defined the ipAddress parameter from the trigger input, which you can dynamically map to this step.”

Exact Extract: “After the Connector step is the Approval step. You can manually add a description, or you can use the Dynamic Values window to populate fields such as the Description field.”

The correct answer is A . The workflow requires analyst-supplied input, so it must begin with a Manual trigger where the IP address is entered. That IP address is passed directly into the FortiSIEM Get Device Information connector action. The output from that connector action is then shown to the SOC manager through an Approval step. If approved, the playbook proceeds to Create Record , creating the asset record from the FortiSIEM CMDB result.

Option B is bloated. Set Variable steps are not required because the manual trigger value and connector output can be referenced directly through Dynamic Values/Jinja. Option C is wrong because On Create is event-driven, not manual input, and Manual Task does not provide the same approve/reject workflow as an Approval step. Option D is wrong because it lacks the manual trigger and adds an unnecessary Update Record step.

Technical Deep Dive: The clean FortiSOAR pattern is Manual Input → External Lookup → Human Approval → Record Creation. In implementation, the manual trigger captures device_ip, the FortiSIEM connector action maps that value to Device IP, the Approval step displays key returned fields such as hostname, IP, organization, device type, and CMDB attributes, and the Create Record step maps the approved output into the Assets module. This is SOAR workflow orchestration; FortiGate NP/CP hardware offload is irrelevant because no traffic forwarding or ASIC inspection path is involved.