Perform Investigations to Detect Threats NSE6-FORTINDR-CLOUD-ANALYST Practice Questions (Page 2)

Questions 6–10

1. 6foundation · easy

   Why is it important to identify changes in attacker TTPs over time?

   • ATo adapt detection strategies to evolving threats
   • BTo encrypt all network traffic
   • CTo automatically patch vulnerabilities
   • DTo reduce the number of false positives
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   An analyst is investigating a malware detection on a single endpoint. The alert references a file hash, but the local sandbox analysis was inconclusive. The analyst needs to determine if this exact file has been seen elsewhere and if it is known malware. Which action should the analyst take?

   • AChange the search filter to show only 'Critical' severity alerts.
   • BCreate a timeline of the endpoint's process execution events.
   • CReview the packet capture for the endpoint's traffic during the infection.
   • DSearch the file hash in the VirusTotal integration.
   Reveal Solution Discussion Select an answer first
4. 8foundation · easy

   What is the primary purpose of using OSINT sources integrated with FortiNDR Cloud during an investigation?

   • ATo encrypt network traffic between endpoints
   • BTo replace the need for internal log analysis
   • CTo automatically remediate all detected threats
   • DTo gather threat intelligence from publicly available sources
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   Which detection use case would involve investigating unusual outbound connections to a known malicious IP?

   • APhishing
   • BMalware
   • CData exfiltration
   • DLateral movement
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   What is the goal of analyzing external entities such as IPs, domains, and URLs during an investigation?

   • ATo determine their reputation and threat relevance
   • BTo encrypt communications with the entity
   • CTo identify the internal owner of the entity
   • DTo configure firewall rules automatically
   Reveal Solution Discussion Select an answer first