Explain FortiNDR Cloud Integration (API/connectors) NSE6-FORTINDR-CLOUD-ANALYST Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A security analyst is using the FortiNDR Cloud API to investigate a specific detection. The analyst needs to find all detections that share the same indicator of compromise (IOC) as the current detection. Which API function would be most useful for this task?

   • AAn endpoint that lists all available API functions.
   • BAn endpoint that returns the status of all sensors.
   • CAn endpoint that allows searching for detections by IOC.
   • DAn endpoint that updates the analyst's user profile.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A security operations center (SOC) uses FortiNDR Cloud to detect network-based threats and a separate SIEM platform for centralized alert management. The SOC manager wants detection events from FortiNDR Cloud to appear automatically in the SIEM without requiring analysts to manually copy data between the two systems. Which action should the administrator take to meet this requirement?

   • ADeploy a second FortiNDR Cloud sensor and point its output directly at the SIEM's database.
   • BConfigure the FortiNDR Cloud connector to forward detection events to the SIEM via the supported integration.
   • CCreate a scheduled export of detection events from FortiNDR Cloud and manually import the file into the SIEM daily.
   • DAsk the SIEM vendor to write a custom parser for FortiNDR Cloud's proprietary log format.
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   Which authentication method is commonly used to access the FortiNDR Cloud API?

   • AClient-side SSL certificate only
   • BUsername and password in the URL
   • CMAC address filtering
   • DAPI key authentication
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   An administrator is configuring the FortiNDR Cloud connector for a new SIEM integration. The administrator has already created the API token in FortiNDR Cloud. What additional information is typically required to complete the connector configuration in the SIEM?

   • AThe serial number of the FortiNDR Cloud sensor.
   • BThe administrator's email address for FortiNDR Cloud.
   • CThe FortiNDR Cloud API base URL or endpoint.
   • DThe IP address of the FortiNDR Cloud sensor.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A security analyst is investigating an alert in the FortiEDR panel. The alert is linked to a network detection from FortiNDR Cloud. The analyst identifies the affected endpoint and wants to contain the threat immediately from the same interface. What capability does the FortiEDR panel integration with FortiNDR Cloud provide in this situation?

   • AThe ability to isolate the affected endpoint directly from the FortiEDR panel.
   • BThe ability to reconfigure the FortiNDR Cloud sensor from the FortiEDR panel.
   • CThe ability to automatically block the threat's IP address on the firewall.
   • DThe ability to view the raw network packets captured by FortiNDR Cloud.
   Reveal Solution Discussion Select an answer first