Analyze Detections and Behavioral Observations NSE6-FORTINDR-CLOUD-ANALYST Practice Questions (Page 6)

Questions 26–30

1. 26foundation · easy

   In FortiNDR Cloud, what does the confidence score of a detection primarily indicate?

   • AThe time required to investigate the detection
   • BThe potential impact of the threat on the organization
   • CThe likelihood that the detection is a true positive
   • DThe number of affected hosts
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A security analyst sees a detection named 'Suspicious PowerShell Execution' with a severity of 'High' and a confidence score of 40. The detector type is 'Behavioral' and the source is 'Endpoint Sensor'. The analyst must decide how to prioritize this alert. What should the analyst do first?

   • AReview the confidence score and correlate with other detections before escalating.
   • BMark the detection as a false positive because the confidence is low.
   • CEscalate to a senior analyst because the detector type is Behavioral.
   • DInvestigate the alert immediately because the severity is High.
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   Which tool or feature in FortiNDR Cloud allows an analyst to see all hosts that communicated with a malicious IP address associated with a detection?

   • AImpact scoping view
   • BThreat intelligence feed
   • CResolution actions menu
   • DDetector details pane
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   What is the primary purpose of behavioral observations in FortiNDR Cloud?

   • ATo list all known malware signatures
   • BTo display the network topology
   • CTo show the sequence of events that triggered a detection
   • DTo provide the analyst's personal notes
   Reveal Solution Discussion Select an answer first
6. 30foundation · easy

   When an analyst correlates an IOC with threat intelligence, what is the primary benefit?

   • AIt changes the severity of the detection
   • BIt deletes the IOC from the system
   • CIt automatically resolves the detection
   • DIt provides additional context about the threat actor or campaign
   Reveal Solution Discussion Select an answer first