Configure IQL Query to Match Security Events NSE6-FORTINDR-CLOUD-ANALYST Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   How would you use IQL to search for security events involving a specific IP address?

   • ABy querying the `hash` field with the IP address value
   • BBy querying the `domain` field with the IP address value
   • CBy querying the `username` field with the IP address value
   • DBy querying the `src_ip` field with the IP address value
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   How can you combine multiple conditions in a single IQL query to refine results?

   • ABy writing multiple separate queries and merging the results manually
   • BBy using the `WHERE` keyword before each condition
   • CBy using the `AND` operator between conditions
   • DBy using the `OR` operator only, because `AND` is not supported
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   Which field would you use in an IQL query to filter email events by the sender's email address?

   • Arecipient
   • Bsender
   • Csubject
   • Dattachment
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   What does the global map output in IQL query results visualize?

   • AThe severity distribution of events
   • BThe network topology of the organization
   • CThe geographic locations of security events
   • DThe timeline of events over time
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   Which IQL query would correctly search for events associated with a specific domain name?

   • Ausername = 'example.com'
   • Bdomain = 'example.com'
   • Chash = 'example.com'
   • Dip = 'example.com'
   Reveal Solution Discussion Select an answer first