Analyze Detections and Behavioral Observations NSE6-FORTINDR-CLOUD-ANALYST Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   An analyst is examining a detection that shows a process creating multiple files in a short time. The analyst wants to understand if this behavior is typical for the application. What should the analyst do?

   • ACompare the behavioral observations with baseline behavior for the application.
   • BQuarantine the process immediately to stop the file creation.
   • CMark the detection as a false positive because the process is a known application.
   • DSearch for the file names in threat intelligence feeds.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A detection indicates that a specific file hash was observed on three hosts in the finance department. The analyst needs to determine the full scope of the infection. Which tool or feature should the analyst use?

   • ASearch the IOC across all endpoints to identify any other hosts with the same hash.
   • BReview the behavioral observations for the three hosts only.
   • CEscalate to a senior analyst to manually check each host.
   • DCheck the network segments associated with the finance department.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   Which resolution action should be taken when a detection is confirmed as a real threat and the incident has been fully remediated?

   • AEscalate
   • BDelete detection
   • CMark as resolved
   • DMark as false positive
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   An analyst is working through the investigation stages for a detection. The analyst has identified the affected host, the user, and the malicious process. The analyst has also confirmed that the process is malicious and has quarantined the host. What is the next step in the investigation stages?

   • AEscalate the detection to a higher tier for a final review.
   • BRestore the host from a backup immediately.
   • CDocument the investigation and close the detection.
   • DSearch for related IOCs to identify any other affected hosts.
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   An analyst is investigating a detection with a severity of 'Medium' and a confidence of 80. The detection is a behavioral alert for an unusual outbound connection from a server. The analyst has limited time and must decide whether to investigate now or later. The server is a development environment with no sensitive data. What should the analyst do?

   • AEscalate the detection to a senior analyst for a second opinion.
   • BQuarantine the server immediately to prevent any potential data exfiltration.
   • CInvestigate now because the confidence is high, even though severity is medium.
   • DDefer the investigation because the server is a development environment with no sensitive data.
   Reveal Solution Discussion Select an answer first