Explain FortiNDR Cloud Integration (API/connectors) NSE6-FORTINDR-CLOUD-ANALYST Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A security analyst is writing a script to generate a daily summary report of all detections from the past 24 hours. The report should include the detection name, severity, and source IP. Which FortiNDR Cloud API function is most appropriate for this task?

   • AAn endpoint that updates the status of a detection.
   • BAn endpoint that manages API tokens for other users.
   • CAn endpoint that lists detections with configurable filters and time ranges.
   • DAn endpoint that retrieves the configuration of a specific sensor.
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   What is the main benefit of integrating the FortiEDR panel with FortiNDR Cloud?

   • AIt only shares licensing information between the two products
   • BIt eliminates the need for any other security tools
   • CIt provides a unified view of network and endpoint detections
   • DIt allows FortiNDR Cloud to replace the FortiEDR agent
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   Which action is typically performed by an analyst when using FortiEDR to isolate a host?

   • AReinstalling the operating system on the host
   • BChanging the host's IP address manually
   • CSelecting the host and triggering the isolation action from the FortiEDR console
   • DPhysically disconnecting the host's network cable
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   What is the purpose of using FortiEDR to isolate a compromised host?

   • ATo prevent the host from communicating with other network devices
   • BTo monitor the host's CPU usage
   • CTo delete all files on the host automatically
   • DTo upgrade the host's operating system
   Reveal Solution Discussion Select an answer first
6. 10application · medium

   During an investigation, an analyst identifies a compromised host on the network. The host is running the FortiEDR agent. The analyst wants to immediately prevent the host from communicating with other devices on the network while preserving the ability to investigate it. Which action should the analyst take from the FortiEDR console?

   • ACreate a firewall rule on the core switch to block the host's MAC address.
   • BDisable the FortiEDR agent on the host.
   • CDelete the host's entry from the FortiNDR Cloud asset inventory.
   • DInitiate host isolation for the compromised endpoint.
   Reveal Solution Discussion Select an answer first