Analyze Detections and Behavioral Observations NSE6-FORTINDR-CLOUD-ANALYST Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   Which detector metadata attribute indicates whether the detection was generated by a signature-based rule or by an anomaly-based model?

   • ADetector name
   • BDetector type
   • CDetection timestamp
   • DAffected host
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   Which stage of an investigation involves determining the appropriate resolution action?

   • ABehavioral analysis
   • BInitial alert review
   • CImpact scoping
   • DFinal resolution
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   An analyst is investigating a detection and has identified the affected host, the user, and the malicious file. The analyst has also confirmed that the file is malicious. What is the next step in the investigation stages?

   • AEscalate the detection to a higher tier for a second opinion.
   • BSearch for additional IOCs to expand the investigation.
   • CDetermine the appropriate resolution action based on the investigation outcome.
   • DClose the detection without any action because the threat is confirmed.
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   An analyst is reviewing two detections: Detection A has a severity of 'Critical' and a confidence of 90. Detection B has a severity of 'High' and a confidence of 95. The analyst can only investigate one at a time. Which detection should the analyst prioritize?

   • AInvestigate both simultaneously because they are both high priority.
   • BPrioritize Detection A because its higher severity indicates greater potential impact, and its confidence is still high enough to warrant immediate attention.
   • CDetection A because it has a higher severity.
   • DDetection B because it has a higher confidence.
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A detection includes an IOC of a suspicious domain. The analyst wants to determine if any other hosts in the environment have communicated with this domain. What should the analyst do?

   • AReview the detector details to see the source of the detection.
   • BSearch the IOC across all network traffic logs and endpoint data.
   • CMark the detection as a false positive because the domain is not in the threat intel feed.
   • DQuarantine the domain in the firewall to block access.
   Reveal Solution Discussion Select an answer first