Explain the FortiNDR Cloud Architecture NSE6-FORTINDR-CLOUD-ANALYST Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A SOC manager is evaluating the FortiNDR Cloud front-end to determine if it can support the team's workflow. The team needs to be able to search for specific entities, view the relationships between entities, and pivot from an alert to related entities for investigation. Which front-end feature should the SOC manager evaluate to determine if it supports this workflow?

   • AThe Dashboard, which provides a high-level overview of the environment's security posture.
   • BThe Entity Explorer, which allows users to search for entities and visualize their relationships with other entities.
   • CThe Detection Rules page, which shows the configuration of detection rules and their associated entities.
   • DThe Alert Details page, which shows the details of a single alert and its associated entities.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A security analyst at a large enterprise is reviewing a FortiNDR Cloud alert for a suspicious file download. The alert includes the source and destination IP addresses, the file hash, and the user agent string. The analyst wants to determine if the file hash has been seen in any other customer environments and if it is associated with any known threat actor groups. Which FortiNDR Cloud back-end process is responsible for providing this additional context?

   • AEnrichment, which correlates the extracted entity with global threat intelligence and community-wide telemetry.
   • BDetection matching, which compares the file hash against a local signature database to identify a known malware family.
   • CIntelligence correlation, which links the file hash to a specific MITRE ATT&CK technique in the alert details.
   • DEntity information extraction, which parses the network traffic to identify the file hash as a distinct entity.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   How does FortiNDR Cloud use detection matching to identify threats?

   • ABy randomly sampling traffic to find anomalies
   • BBy comparing extracted entities and behaviors against known detection rules
   • CBy blocking all traffic from unknown sources
   • DBy requiring manual review of all traffic
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A security administrator is configuring FortiNDR Cloud for a new deployment. The administrator wants to ensure that raw network traffic metadata is stored for 30 days, while detection events are stored for 90 days. The administrator also needs to ensure that the storage configuration is applied consistently across all data sources. What should the administrator do in the FortiNDR Cloud portal?

   • AConfigure a single global retention policy that applies the same retention period to all data types.
   • BUse the default retention settings, which automatically store metadata for 30 days and detection events for 90 days.
   • CConfigure separate retention policies for metadata and detection events, and apply them to all data sources.
   • DExport all metadata to an external storage solution after 30 days and keep detection events in FortiNDR Cloud for 90 days.
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   What is the role of intelligence correlation in FortiNDR Cloud's threat detection process?

   • ATo remove false positives by deleting all alerts
   • BTo encrypt threat intelligence data
   • CTo store intelligence in a separate database
   • DTo combine multiple pieces of evidence to identify complex threats
   Reveal Solution Discussion Select an answer first