Which security implication is most directly associated with SMB events in FortiNDR Cloud?

Detecting SQL injection attempts against web applications.

Monitoring TLS certificate expiration dates.

Tracking DNS tunneling attempts.

Identifying ransomware activity that encrypts files on network shares.

A security analyst is reviewing a Flow event and sees a large amount of data being transferred from an internal host to an external IP address. The analyst needs to determine the direction of the data transfer and the total amount of data sent. Which Flow event fields should the analyst examine?

http_method, http_uri, http_status

dns_query, dns_response, src_ip

src_ip, dst_ip, src_port, dst_port

bytes_sent, bytes_received, src_ip, dst_ip

FortinetNSE 6 - FortiNDR Cloud Analyst

Domain 2Objective 1

Explain Event Types and Fields NSE6-FORTINDR-CLOUD-ANALYST Practice Questions (Page 2)

Part of the Events and Queries domain, which accounts for 25-35% of the NSE6-FORTINDR-CLOUD-ANALYST exam.

31questions here

7free pages

9concepts

25-35%of the exam

Questions 6–10

6foundation · easy
Which security implication is most directly associated with SMB events in FortiNDR Cloud?
Select an answer first
7application · medium
A security analyst is reviewing a Flow event and sees a large amount of data being transferred from an internal host to an external IP address. The analyst needs to determine the direction of the data transfer and the total amount of data sent. Which Flow event fields should the analyst examine?
Select an answer first
8foundation · easy
An analyst is investigating a potential data exfiltration and wants to find sessions where an unusually large amount of data was sent from an internal host to an external server. Which Flow event field should be examined?
Select an answer first
9expert · hard
An analyst is investigating a web application attack. The analyst sees an HTTP event with a 200 status code and a large response body. The analyst needs to determine if the response contains sensitive data. Which HTTP event field would be most useful for this analysis?
Select an answer first
10foundation · easy
In FortiNDR Cloud, which network protocol event type is primarily used to record metadata about the communication session between two hosts, including IP addresses, ports, and byte counts, without capturing the full payload?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to NSE6-FORTINDR-CLOUD-ANALYST

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Fortinet. “NSE6-FORTINDR-CLOUD-ANALYST” is a trademark of its owner, used for identification only.

Explain Event Types and Fields NSE6-FORTINDR-CLOUD-ANALYST Practice Questions (Page 2)

Questions 6–10

Which security implication is most directly associated with SMB events in FortiNDR Cloud?

A security analyst is reviewing a Flow event and sees a large amount of data being transferred from an internal host to an external IP address. The analyst needs to determine the direction of the data transfer and the total amount of data sent. Which Flow event fields should the analyst examine?

An analyst is investigating a potential data exfiltration and wants to find sessions where an unusually large amount of data was sent from an internal host to an external server. Which Flow event field should be examined?

An analyst is investigating a web application attack. The analyst sees an HTTP event with a 200 status code and a large response body. The analyst needs to determine if the response contains sensitive data. Which HTTP event field would be most useful for this analysis?

In FortiNDR Cloud, which network protocol event type is primarily used to record metadata about the communication session between two hosts, including IP addresses, ports, and byte counts, without capturing the full payload?

Keep studying — Events and Queries