FortinetNSE 6 - FortiNDR Cloud Analyst
Domain 2Objective 1
Explain Event Types and Fields NSE6-FORTINDR-CLOUD-ANALYST Practice Questions (Page 6)
Part of the Events and Queries domain, which accounts for 25-35% of the NSE6-FORTINDR-CLOUD-ANALYST exam.
31questions here
7free pages
9concepts
25-35%of the exam
Questions 26–30
- 26
Which DCE/RPC event field would an analyst examine to determine the RPC service or functionality being accessed, such as the SAMR interface used for password policy enumeration?
Select an answer first - 27
In a FortiNDR Cloud HTTP event, which field contains the specific resource path requested from the web server, such as '/login.php'?
Select an answer first - 28
An analyst is investigating a suspicious SSL connection to an external IP address. The analyst needs to determine the version of TLS being used and the certificate details. Which SSL event fields should the analyst examine?
Select an answer first - 29
An analyst is investigating a host that is using a self-signed certificate for an SSL connection. The analyst needs to determine if this is a legitimate internal service or a potential man-in-the-middle attack. Which SSL event fields should the analyst examine to make this determination?
Select an answer first - 30
An analyst is investigating a host that is beaconing to an external IP every 60 seconds. The analyst wants to determine whether the beaconing traffic is encrypted or plaintext, and whether it is using a standard or non-standard port. Which event type should the analyst pivot to first to make this determination?
Select an answer first
Finished these 5 questions?
Review the revealed explanations, or continue through the curriculum.
Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Fortinet. “NSE6-FORTINDR-CLOUD-ANALYST” is a trademark of its owner, used for identification only.