Analyze Detections and Behavioral Observations NSE6-FORTINDR-CLOUD-ANALYST Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   During an investigation, an analyst confirms that a detection was triggered by a legitimate administrative script that runs nightly. The script is expected and has been approved by the IT team. What resolution action should the analyst take?

   • AQuarantine the affected host to prevent further activity.
   • BEscalate the detection to a higher tier for further analysis.
   • CMark the detection as a false positive and add the script to an allowlist.
   • DDelete the detection from the system without any further action.
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   An analyst is investigating a detection that indicates a malware infection on a single workstation. The analyst has confirmed the malware is present and has identified the file path. The workstation is used by a remote employee who is currently online. The analyst must choose a resolution action that minimizes disruption while containing the threat. What should the analyst do?

   • AAllow the employee to continue working while the analyst monitors the situation.
   • BDisconnect the workstation from the network and then remove the malware.
   • CEscalate the detection to a higher tier without taking any action.
   • DQuarantine the workstation immediately to contain the threat.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A detection with high severity and high confidence indicates that a specific user account has been compromised. The analyst needs to determine which network segments the user has accessed recently. What tool or feature should the analyst use?

   • AQuarantine the user account immediately.
   • BReview the behavioral observations for the user account.
   • CSearch for the user account in the network traffic logs.
   • DCheck the detector details for the source IP.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   Which of the following is an example of a behavioral observation in a detection?

   • AThe detector name is 'Brute Force Login'
   • BA host made multiple failed login attempts followed by a successful login
   • CThe affected host is 10.0.0.5
   • DThe severity is rated as high
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   An analyst is reviewing a detection that shows a sequence of events: a user received a phishing email, clicked a link, and then a suspicious process executed. The analyst needs to understand the full chain of activity. What should the analyst do?

   • AImmediately quarantine the user's machine based on the email.
   • BAnalyze the behavioral observations to map the sequence of events.
   • CSearch for the email subject in the threat intelligence feed.
   • DMark the detection as a false positive because the user clicked a link.
   Reveal Solution Discussion Select an answer first