Identify the FortiNDR Cloud Sensors NSE6-FORTINDR-CLOUD-ANALYST Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   Which information is typically required during the sensor registration process?

   • AThe name of the sensor's manufacturer
   • BThe MAC address of the sensor's network interface
   • CThe sensor's serial number or activation code
   • DThe sensor's IP address and subnet mask
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   What does a FortiNDR Cloud sensor produce from the network traffic it observes?

   • AFirewall rules
   • BUser credentials
   • CMetadata
   • DEncryption keys
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   An analyst is reviewing FortiNDR Cloud events for a compromised host. The analyst wants to identify the command-and-control (C2) communication pattern. Which event type would be most directly relevant to detecting C2 traffic?

   • AFile events showing a downloaded executable
   • BConnection events showing repeated connections to an external IP on a non-standard port
   • CDNS events showing queries to a known malicious domain
   • DHTTP events showing requests to a suspicious URL
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A security team is tuning their FortiNDR Cloud alerts to reduce noise. They notice that a particular alert is triggered by a large number of connections to a legitimate file-sharing service. The team wants to filter out these connections while still retaining visibility into the metadata for future investigations. Which metadata field would be most effective for creating this filter?

   • ADestination port
   • BPacket count
   • CDestination IP address
   • DApplication name
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   How do FortiNDR Cloud sensors contribute to MITRE ATT&CK-based detections?

   • ABy blocking all traffic associated with known ATT&CK techniques
   • BBy providing network metadata that can be mapped to ATT&CK techniques
   • CBy automatically patching vulnerabilities
   • DBy replacing the need for endpoint detection and response
   Reveal Solution Discussion Select an answer first