Analyze Detections and Behavioral Observations NSE6-FORTINDR-CLOUD-ANALYST Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   What type of information is typically shown in the impact scoping view of a detection?

   • AThe configuration settings of the detection rule
   • BAffected hosts, users, and network segments
   • CThe list of all detectors that have ever fired
   • DThe full packet capture of the malicious traffic
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   In FortiNDR Cloud, when reviewing a detection, which metadata field identifies the specific rule or model that generated the alert?

   • ASource IP address
   • BSeverity level
   • CConfidence score
   • DDetector name
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   An analyst is reviewing a detection that was triggered by a network sensor. The detector details show that the detection type is 'Signature' and the source is 'Network Sensor'. The analyst needs to determine which hosts are affected. What should the analyst do?

   • AUse the network sensor logs to identify the source and destination IPs involved in the detection.
   • BMark the detection as a false positive because it is a signature-based detection.
   • CQuarantine the network segment where the sensor is located.
   • DReview the behavioral observations to see the process that triggered the detection.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   What is the primary purpose of using indicators of compromise (IOCs) in an investigation?

   • ATo configure the detection rules
   • BTo generate a final report
   • CTo search for related activity across the network
   • DTo assign severity scores to detections
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   A detection indicates that a malicious file was downloaded on a host in the marketing department. The analyst needs to determine the full scope of the infection, including any lateral movement. The analyst has access to network logs, endpoint data, and threat intelligence. What is the most efficient approach?

   • AQuarantine the marketing department's network segment to prevent spread.
   • BReview the behavioral observations for the initial host only.
   • CCheck the threat intelligence feed for the file hash to see if it is known.
   • DSearch for the file hash across all endpoints and network logs.
   Reveal Solution Discussion Select an answer first