Implement Detectors NSE6-FORTINDR-CLOUD-ANALYST Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A media company has a detector for 'Phishing' that monitors a set of 50 IPs. A new employee is hired and assigned a workstation with IP 10.2.3.4. The security team wants to ensure the new workstation is monitored. What is the most appropriate action?

   • ACreate a new detector for the new workstation
   • BIncrease the detector's sensitivity to cover more assets
   • CRemove an existing IP from the run list to make room
   • DAdd 10.2.3.4 to the detector's run list
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   Which setting in FortiNDR Cloud directly controls how strict a detector is when deciding whether to generate an alert?

   • ADetector description
   • BDetector name
   • CRun list
   • DSensitivity threshold
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   A security architect is designing a detection strategy for a multi-tenant environment. The architect needs to create a detector for 'Exfiltration' that monitors only the tenants that have opted into the service. Each tenant has a set of IPs. The architect wants to minimize false positives by using different sensitivity levels per tenant. What is the best approach?

   • ACreate a separate detector for each tenant with tenant-specific run lists and thresholds
   • BCreate a single detector with all tenant IPs and a very low threshold
   • CCreate a single detector with a run list containing all opted-in tenant IPs and a moderate threshold
   • DCreate a single detector with no run list and a very high threshold
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   A large enterprise has a detector for 'Beaconing' that monitors 500 IPs across multiple departments. The security team is receiving too many alerts from the marketing department, which uses a legitimate scheduling tool that generates periodic traffic. The team needs to reduce false positives from marketing without reducing detection sensitivity for other departments. What is the best approach?

   • ARemove marketing IPs from the run list entirely
   • BIncrease the threshold of the original detector to reduce alerts globally
   • CDisable the detector during marketing's business hours
   • DCreate a separate detector for marketing with a higher threshold and remove marketing IPs from the original detector's run list
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A financial institution has a detector for 'Anomalous Outbound Traffic' that monitors a set of 300 IPs. The security team notices that the detector is not alerting on a compromised server (10.5.5.50) that is sending large amounts of data to an external IP. The server is in the run list. What is the most likely reason the detector is not alerting?

   • AThe detector's description is incorrect
   • BThe detector is disabled
   • CThe detector's threshold is set too high, so the traffic volume does not exceed the alerting threshold
   • DThe server's IP was removed from the run list
   Reveal Solution Discussion Select an answer first