Explain the FortiNDR Cloud Architecture NSE6-FORTINDR-CLOUD-ANALYST Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   How does FortiNDR Cloud store data to support its analytics and search functions?

   • AIn a scalable cloud-based storage architecture optimized for search and retrieval
   • BIn a single, non-scalable database
   • COn the customer's local hard drives
   • DIn read-only memory (ROM) for faster access
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   Which management function is available in the FortiNDR Cloud portal for administrators?

   • AInstalling operating system patches on the cloud servers
   • BCreating and managing user accounts and roles
   • CConfiguring the physical network switches
   • DManaging the customer's on-premises firewall rules
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   Which feature is typically available in the FortiNDR Cloud front-end interface?

   • AA direct SSH terminal to the cloud servers
   • BDashboards for visualizing detections and network activity
   • CA tool for compiling custom detection rules
   • DA command-line interface for configuring the back-end
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   A security operations center (SOC) is investigating a low-confidence alert that flagged an internal host communicating with a known command-and-control (C2) domain. The alert was generated based on a single DNS query. The SOC lead wants to increase confidence in the alert before escalating it. The team has access to FortiNDR Cloud's full back-end capabilities. Which action would most effectively leverage FortiNDR Cloud's detection and correlation processes to validate this threat?

   • AAllow FortiNDR Cloud's detection matching to correlate the DNS query with other network telemetry, such as subsequent HTTP connections or file downloads from the same host.
   • BDisable the low-confidence alert and create a custom signature to detect the specific C2 domain in the future.
   • CManually search the raw packet captures for other connections from the internal host to the same C2 domain.
   • DReview the entity enrichment data for the C2 domain to see if it is associated with other known malicious infrastructure.
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   Which type of data is typically used to enrich an extracted IP address in FortiNDR Cloud?

   • AThe IP address's historical performance metrics
   • BThe customer's billing information
   • CThreat intelligence feeds and geolocation data
   • DThe user's social media profile
   Reveal Solution Discussion Select an answer first