Configure IQL Query to Match Security Events NSE6-FORTINDR-CLOUD-ANALYST Practice Questions (Page 3)

Questions 11–14

1. 11foundation · medium

   Which IQL operator would you use to match a field value against a list of allowed values, and which operator would you use to match a field value against a partial string pattern?

   • AIN for both the list and the partial pattern
   • BLIKE for both the list and the partial pattern
   • CIN for the list; LIKE for the partial pattern
   • DLIKE for the list; IN for the partial pattern
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   What is the primary purpose of IQL (Investigation Query Language) in FortiNDR Cloud?

   • ATo configure network firewall rules and policies
   • BTo query and filter security events for investigation and analysis
   • CTo automate the deployment of virtual machines in the cloud
   • DTo generate compliance reports for regulatory audits
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   Which of the following is a common use case for IQL in FortiNDR Cloud?

   • ASetting up data retention policies for log storage
   • BSearching for all events involving a specific malicious IP address
   • CConfiguring user access permissions for the FortiNDR Cloud portal
   • DCreating custom dashboards for network performance monitoring
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   What is the correct basic syntax structure for an IQL query in FortiNDR Cloud?

   • AQUERY field_name WITH value
   • Bfield_name = value
   • CSELECT field_name FROM events
   • Dvalue = field_name
   Reveal Solution Discussion Select an answer first