Explain the FortiNDR Cloud Architecture NSE6-FORTINDR-CLOUD-ANALYST Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   What is the primary use case for display mode in FortiNDR Cloud?

   • ATo present dashboards and data on a large screen for visibility
   • BTo configure the back-end analytics engine
   • CTo annotate network traffic in real-time
   • DTo manage user subscriptions
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   A security architect is designing a deployment of FortiNDR Cloud for a multi-national company. The company has network traffic flowing through multiple regional data centers, and the architect needs to ensure that the back-end processes of FortiNDR Cloud can handle the volume of data from all regions. The architect is particularly concerned about the entity extraction process, as the company's traffic includes a high volume of encrypted traffic. What should the architect consider regarding FortiNDR Cloud's back-end architecture to ensure effective entity extraction from encrypted traffic?

   • AFortiNDR Cloud relies on the customer to provide decrypted traffic via a network tap or SPAN port to ensure entity extraction can occur.
   • BFortiNDR Cloud uses deep packet inspection (DPI) to decrypt all TLS traffic before entity extraction, ensuring full visibility.
   • CFortiNDR Cloud extracts entities from encrypted traffic by analyzing metadata such as IP addresses, ports, and connection patterns, without requiring decryption.
   • DThe entity extraction process is limited to unencrypted traffic, so the architect must ensure all traffic is decrypted at the network edge before it reaches FortiNDR Cloud.
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   What capability does the FortiNDR Cloud front-end provide for investigating a specific detection?

   • AThe ability to block the attacker's IP address directly from the interface
   • BThe ability to modify the underlying detection rules
   • CThe ability to reboot the cloud servers
   • DDrill-down views that show related entities and events
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A large organization has multiple business units that need to access FortiNDR Cloud. The security administrator wants to ensure that each business unit can only view alerts and data related to their own network segment. The administrator also needs to delegate the ability to manage users within each business unit to a designated team lead. Which portal management feature should the administrator use to achieve this?

   • AAssign each business unit a custom role with view-only permissions and no user management capabilities.
   • BUse annotation provisioning to tag alerts with the business unit name and then filter by tag.
   • CCreate a single tenant and use display mode to filter the dashboard for each business unit.
   • DCreate a separate tenant for each business unit and assign the team lead as the tenant administrator.
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   Which characteristic best describes the deployment model of FortiNDR Cloud?

   • AIt is installed on customer-managed virtual machines in the customer's data center
   • BIt is delivered as a software-as-a-service (SaaS) offering hosted by Fortinet
   • CIt is deployed as a physical appliance in the customer's network
   • DIt is a hybrid deployment requiring both cloud and on-premises components for basic operation
   Reveal Solution Discussion Select an answer first