Perform Investigations to Detect Threats NSE6-FORTINDR-CLOUD-ANALYST Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   Which investigation technique involves placing events in chronological order to understand an incident?

   • AFile hash investigation
   • BPacket capture analysis
   • COSINT integration
   • DTimeline creation
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   An analyst is investigating a suspected lateral movement incident. The alert shows a single authentication from Host A to Host B. The analyst needs to understand the full sequence of events leading up to and following this authentication to confirm the scope. What is the most effective first step in FortiNDR Cloud?

   • AReview the DNS resolution type for the domain used in the authentication.
   • BCreate a timeline centered on the affected hosts and the alert timestamp.
   • CCheck the VirusTotal reputation of Host B's IP address.
   • DSearch for all alerts with severity 'High' in the last 24 hours.
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   Which type of indicator can be checked using the VirusTotal integration in FortiNDR Cloud?

   • AOnly email addresses
   • BOnly IP addresses
   • CFile hashes, URLs, and domains
   • DOnly network ports
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   What is the purpose of an outbreak investigation workflow in FortiNDR Cloud?

   • ATo automatically quarantine all affected devices
   • BTo replace the need for manual analysis
   • CTo apply a structured process for investigating widespread threats
   • DTo encrypt all outbreak-related data
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   Which activity is an example of external entity analysis?

   • ACreating a timeline of events
   • BChecking the reputation of a suspicious domain
   • CReviewing internal user login logs
   • DConfiguring a new data source
   Reveal Solution Discussion Select an answer first