A security team needs to create a detector for 'Insider Threat' that monitors a specific set of privileged users (10.1.1.0/24). The team wants to minimize false positives by only alerting on unusual behavior. During creation, which combination of settings best achieves this goal?

Define a name, add all IPs to the run list, and set a very low sensitivity threshold

Define a description, set a moderate threshold, and skip the run list

Define a descriptive name, add the privileged IPs to the run list, and set a moderate sensitivity threshold

Define a name, set a very high sensitivity threshold, and skip the run list

A logistics company has a detector for 'Command & Control' that monitors a set of 100 IPs. A new office is opened with 15 new workstations that need to be monitored. What is the most efficient way to include the new workstations in the detector?

Create a new detector for the new office

Increase the detector's sensitivity to cover more assets

Remove the existing IPs and add the new ones

Add the 15 new IPs to the detector's run list

What is the function of a run list in FortiNDR Cloud detectors?

It specifies which assets or IP addresses the detector applies to

It defines the detection parameters such as sensitivity and thresholds

It stores the historical alerts generated by the detector

It determines the frequency at which the detector runs

When creating a new detector in FortiNDR Cloud, which fields are required to be defined during the initial setup?

Name, description, and initial detection parameters

Name, description, and run list

Description and sensitivity threshold only

A security analyst at a hospital network needs to detect unusual outbound data transfers from the finance department's workstations. The finance team uses a dedicated subnet (10.10.5.0/24) with 40 static IPs. The analyst creates a new detector but wants to ensure it only monitors the finance workstations and not the rest of the hospital network. What should the analyst configure first?

Create a new asset group and assign it to the detector's description field

Adjust the threshold to 500 MB per hour for outbound transfers

Set the detector's sensitivity to 'High' and enable all detection categories

Define a run list containing the 40 finance workstation IP addresses

FortinetNSE 6 - FortiNDR Cloud Analyst

Domain 3Objective 2

Implement Detectors NSE6-FORTINDR-CLOUD-ANALYST Practice Questions (Page 3)

Part of the Detection domain, which accounts for 15-25% of the NSE6-FORTINDR-CLOUD-ANALYST exam.

22questions here

5free pages

3concepts

15-25%of the exam

Questions 11–15

11expert · hard
A security team needs to create a detector for 'Insider Threat' that monitors a specific set of privileged users (10.1.1.0/24). The team wants to minimize false positives by only alerting on unusual behavior. During creation, which combination of settings best achieves this goal?
Select an answer first
12application · medium
A logistics company has a detector for 'Command & Control' that monitors a set of 100 IPs. A new office is opened with 15 new workstations that need to be monitored. What is the most efficient way to include the new workstations in the detector?
Select an answer first
13foundation · easy
What is the function of a run list in FortiNDR Cloud detectors?
Select an answer first
14foundation · easy
When creating a new detector in FortiNDR Cloud, which fields are required to be defined during the initial setup?
Select an answer first
15application · medium
A security analyst at a hospital network needs to detect unusual outbound data transfers from the finance department's workstations. The finance team uses a dedicated subnet (10.10.5.0/24) with 40 static IPs. The analyst creates a new detector but wants to ensure it only monitors the finance workstations and not the rest of the hospital network. What should the analyst configure first?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to NSE6-FORTINDR-CLOUD-ANALYST

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Fortinet. “NSE6-FORTINDR-CLOUD-ANALYST” is a trademark of its owner, used for identification only.