Implement Detectors NSE6-FORTINDR-CLOUD-ANALYST Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A university's IT team manages a detector for 'Credential Harvesting' that currently monitors all student lab machines. After a security review, they need to exclude a specific research lab (10.20.30.0/24) where legitimate credential-caching software is used, causing false positives. What is the most appropriate way to exclude this subnet from the detector?

   • ARemove the research lab IPs from the detector's run list
   • BChange the detector's description to note the research lab exclusion
   • CLower the detector's sensitivity to reduce alerts globally
   • DCreate a separate detector for the research lab with higher thresholds
   Reveal Solution Discussion Select an answer first
2. 7expert · hard

   A security analyst is tuning a detector for 'Brute Force' that monitors a set of 200 IPs. The detector is currently generating 50 alerts per day, but only 5 are confirmed as real brute-force attacks. The analyst wants to reduce the false positive rate while keeping the true positive rate high. What is the most effective tuning action?

   • ARemove the 200 IPs from the run list and add them back one by one
   • BIncrease the threshold to require more failed login attempts within a shorter time window
   • CChange the detector's description to note the false positive issue
   • DDecrease the threshold to catch more potential attacks
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A government agency needs to create a detector for 'Data Staging' that monitors a specific set of classified workstations. The analyst wants to ensure the detector is clearly identifiable and has appropriate initial settings. What should the analyst include when creating the detector?

   • AA name, description, and the run list, but no detection parameters
   • BOnly a description and detection parameters
   • CA descriptive name, a detailed description, and initial detection parameters
   • DOnly a name and the run list
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A managed security service provider (MSSP) monitors multiple clients. After deploying a new detector for 'DNS Tunneling', the analyst notices a high volume of alerts from a client that uses a legitimate DNS-based load-balancing service. The alerts are overwhelming the SOC. What should the analyst do to reduce false positives while maintaining detection of actual DNS tunneling?

   • ADisable the detector for that specific client
   • BDelete the detector and recreate it with a different name
   • CAdd the load-balancing service's IP addresses to the run list
   • DIncrease the detector's sensitivity threshold to require more DNS queries per minute
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   A multinational company has a detector for 'Data Exfiltration' that monitors all employee workstations. The compliance team requires that the detector NOT monitor workstations in the EU due to data residency regulations, but the security team wants to maintain monitoring for all other regions. The current run list contains all employee IPs. What is the most appropriate action?

   • ADisable the detector globally and rely on manual monitoring
   • BIncrease the detector's threshold for EU workstations
   • CRemove EU workstation IPs from the run list
   • DCreate a separate detector for EU workstations with lower sensitivity
   Reveal Solution Discussion Select an answer first