Analyze Detections and Behavioral Observations NSE6-FORTINDR-CLOUD-ANALYST Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   When prioritizing multiple detections, which combination of scores should an analyst consider first?

   • AHigh severity and high confidence
   • BLow severity and high confidence
   • CHigh severity and low confidence
   • DLow severity and low confidence
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   After investigating a detection and determining it was a false positive, which resolution action is most appropriate?

   • AMark as resolved
   • BMark as false positive
   • CEscalate
   • DSuppress
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   An analyst is investigating a detection with a severity of 'Low' and a confidence of 60. The detection is a behavioral alert for an unusual process execution on a server. The analyst has limited time and must decide whether to investigate now or later. The server is a domain controller. What should the analyst do?

   • AEscalate the detection to a senior analyst for a second opinion.
   • BInvestigate now because the server is a domain controller, and the potential impact is high despite the low severity.
   • CQuarantine the domain controller immediately to prevent any potential compromise.
   • DDefer the investigation because the severity is low and the confidence is moderate.
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   What is the first stage in a typical investigation workflow in FortiNDR Cloud?

   • AInitial alert review
   • BImpact scoping
   • CFinal resolution
   • DThreat intelligence correlation
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A detection includes an IOC of a specific registry key modification. The analyst wants to know if this modification is part of a known attack pattern. What should the analyst do?

   • AQuarantine the host to prevent further registry changes.
   • BAnalyze the behavioral observations to see the process that made the modification.
   • CCorrelate the IOC with threat intelligence feeds to identify known attack patterns.
   • DMark the detection as a false positive because registry changes are common.
   Reveal Solution Discussion Select an answer first