Explain the FortiNDR Cloud Architecture NSE6-FORTINDR-CLOUD-ANALYST Practice Questions (Page 7)

Questions 31–34

1. 31foundation · easy

   What is the purpose of annotation provisioning in FortiNDR Cloud?

   • ATo set up the display mode for a SOC screen
   • BTo configure the network traffic collectors
   • CTo provision new cloud servers for the customer
   • DTo add notes or context to detections for collaboration
   Reveal Solution Discussion Select an answer first
2. 32foundation · easy

   Which back-end component is responsible for ingesting and processing raw network traffic data in FortiNDR Cloud?

   • AData collection and processing pipeline
   • BOn-premises collector appliance
   • CFront-end web server
   • DCustomer-managed database
   Reveal Solution Discussion Select an answer first
4. 33expert · hard

   A threat hunter is investigating a series of alerts involving a specific internal IP address that has been communicating with multiple external domains. The threat hunter wants to determine if any of these domains are known to be associated with a specific threat actor group that the company is tracking. The threat hunter has access to FortiNDR Cloud's enrichment and intelligence correlation capabilities. Which approach would most effectively leverage these capabilities to identify the threat actor association?

   • AManually cross-reference the external domains with a public threat intelligence feed to identify any known associations.
   • BCreate a custom detection rule that flags any traffic to the external domains and then review the alerts for threat actor information.
   • CExport the list of external domains to a sandbox environment to analyze them for malicious behavior.
   • DUse FortiNDR Cloud's entity enrichment to view the threat intelligence context for each external domain, including any known threat actor associations.
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   A new SOC analyst is learning to use the FortiNDR Cloud front-end interface. The analyst needs to quickly view the overall security posture of the environment, including the number of critical alerts, the top affected assets, and recent threat intelligence updates. Which feature of the FortiNDR Cloud front-end should the analyst use to get this high-level overview?

   • AThe Detection Rules page, which shows the configuration of all active detection rules.
   • BThe Dashboard, which aggregates key metrics, alerts, and threat intelligence into a single customizable view.
   • CThe Alert Details page, which provides a comprehensive view of a single alert's metadata and related entities.
   • DThe Entity Explorer, which allows the analyst to search for specific entities like IPs or domains.
   Reveal Solution Discussion Select an answer first