Explain Event Types and Fields NSE6-FORTINDR-CLOUD-ANALYST Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   In a FortiNDR Cloud DCE/RPC event, which field identifies the specific remote procedure that was invoked on the target host?

   • Adcerpc_opnum
   • Bdcerpc_endpoint
   • Cdcerpc_call_id
   • Ddcerpc_interface
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   Why are DNS events particularly valuable for detecting command-and-control (C2) communication in FortiNDR Cloud?

   • ADNS events are the only event type that records encrypted traffic.
   • BMalware often uses DNS queries to resolve C2 domains, and these queries are rarely blocked by firewalls.
   • CDNS events contain the full payload of the C2 traffic.
   • DDNS events provide the source and destination IP addresses of the C2 server.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   In a FortiNDR Cloud SSL event, which field contains the version of the TLS protocol used in the handshake, such as TLS 1.2 or TLS 1.3?

   • Assl_cipher
   • Bssl_cert_cn
   • Cssl_ja3
   • Dssl_version
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   Which SSL event field would an analyst use to identify the domain name that the TLS certificate was issued to?

   • Assl_cert_cn
   • Bssl_ja3
   • Cssl_version
   • Dssl_cipher
   Reveal Solution Discussion Select an answer first
6. 15expert · hard

   An analyst is investigating a host that is communicating with a known C2 server. The analyst observes that the host is making DNS queries to a domain that resolves to the C2 IP, and then establishing a connection to that IP on port 443. The analyst wants to determine if the C2 traffic is encrypted. Which event types should the analyst correlate to make this determination?

   • ADNS and Flow events
   • BFlow and SMB events
   • CHTTP and SSL events
   • DDNS and HTTP events
   Reveal Solution Discussion Select an answer first