Explain FortiNDR Cloud Integration (API/connectors) NSE6-FORTINDR-CLOUD-ANALYST Practice Questions (Page 5)

Questions 21–25

1. 21expert · hard

   A security operations center uses both FortiEDR and FortiNDR Cloud. An analyst is investigating a complex incident that spans multiple endpoints and involves network-based lateral movement. The analyst has identified the initial compromised host and wants to contain it while continuing to monitor the network for other affected hosts. What is the most effective strategy using the available integrations?

   • AUse the FortiNDR Cloud API to delete all detections related to the compromised host to clean up the alert queue.
   • BDisable the FortiNDR Cloud sensor to prevent it from generating more alerts during the investigation.
   • CIsolate all endpoints that have communicated with the compromised host to ensure no lateral movement occurs.
   • DIsolate the compromised host via FortiEDR and continue monitoring FortiNDR Cloud detections for signs of other compromised hosts.
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   Which integration scenario best demonstrates the use of the FortiNDR Cloud API in investigations?

   • AAutomatically creating a ticket in a SIEM when a high-severity detection is found
   • BUsing the API to change the wallpaper on analyst workstations
   • CManually copying detection details into a spreadsheet
   • DUsing the API to send marketing emails
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   An organization is planning to integrate FortiNDR Cloud with its existing security orchestration, automation, and response (SOAR) platform. The goal is to allow the SOAR platform to trigger host isolation on endpoints protected by FortiEDR when a high-severity network detection is confirmed. What is the primary role of the FortiNDR Cloud connector in this architecture?

   • AIt is a physical appliance that must be deployed in the data center to filter traffic before it reaches the SOAR platform.
   • BIt is used only for reporting and does not support any action-oriented functions like host isolation.
   • CIt acts as the bridge that allows the SOAR platform to communicate with FortiNDR Cloud and, through its integration with FortiEDR, initiate response actions.
   • DIt replaces the need for a SOAR platform by providing built-in automation and response capabilities.
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   During connector configuration, what must be specified to define how FortiNDR Cloud communicates with the external system?

   • AThe connection endpoint and authentication method
   • BThe number of users in the external system
   • CThe physical location of the external system's servers
   • DThe brand of the external system's hardware
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A company uses FortiEDR for endpoint protection and FortiNDR Cloud for network detection. The security team wants to view network detection alerts from FortiNDR Cloud directly within the FortiEDR panel to streamline their investigation workflow. What should the administrator configure to achieve this?

   • AEnable the FortiNDR Cloud integration within the FortiEDR panel settings.
   • BUse the FortiNDR Cloud API to manually pull alerts and display them in a custom dashboard.
   • CDeploy a FortiNDR Cloud sensor on each endpoint protected by FortiEDR.
   • DConfigure FortiEDR to send its logs to FortiNDR Cloud for correlation.
   Reveal Solution Discussion Select an answer first