Implement Detectors NSE6-FORTINDR-CLOUD-ANALYST Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A retail company wants to create a detector to identify 'Lateral Movement' using SMB connections between internal workstations. The security team has already identified a list of 200 internal IPs that should be monitored. Which initial configuration steps are required when creating the new detector?

   • AOnly add the 200 IPs to the run list; the detector name is optional
   • BSet the detection parameters and skip the run list to monitor all assets
   • CDefine the detector name, description, and detection parameters, then add the 200 IPs to the run list
   • DCreate the detector with a name and description, then adjust sensitivity after deployment
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A startup company wants to create a detector for 'Suspicious PowerShell' that monitors their development servers. The team has identified 20 server IPs. During the creation process, what is the minimum required information to create a functional detector?

   • AA name, description, detection parameters, and a run list with the 20 IPs
   • BOnly a description and detection parameters
   • COnly detection parameters and the run list
   • DOnly a name and the run list
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   When managing a run list in FortiNDR Cloud, which action is used to include a new IP address in the detector's scope?

   • AEnable the detector's auto-tune feature
   • BCreate a new detector with the same parameters
   • CAdd an entry to the run list
   • DModify the detector's sensitivity threshold
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A manufacturing company has a detector for 'Malware C2' that monitors a mix of IT and OT (operational technology) assets. The OT assets (10.0.1.0/24) are sensitive to false positives and should not be monitored by this detector. The IT assets (10.0.2.0/24) should be monitored. How should the analyst configure the run list?

   • ALeave the run list empty to monitor all assets
   • BAdd only the OT asset IPs (10.0.1.0/24) to the run list
   • CAdd both IT and OT IPs to the run list
   • DAdd only the IT asset IPs (10.0.2.0/24) to the run list
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   In FortiNDR Cloud, what is the purpose of the 'description' field when creating a new detector?

   • ATo provide a human-readable explanation of the detector's purpose and intended use
   • BTo define the list of assets that the detector will monitor
   • CTo set the sensitivity level of the detector
   • DTo specify the technical parameters that the detector will use to identify threats
   Reveal Solution Discussion Select an answer first