Perform Investigations to Detect Threats NSE6-FORTINDR-CLOUD-ANALYST Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   What is the primary purpose of analyzing packet captures in FortiNDR Cloud?

   • ATo encrypt network communications
   • BTo replace the need for endpoint detection
   • CTo manage user access controls
   • DTo inspect network traffic details and identify malicious patterns
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   Which detection use case would involve investigating a suspicious email link that led to a credential-harvesting page?

   • APhishing
   • BDenial of service
   • CMalware
   • DLateral movement
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   Which type of data is analyzed when performing packet capture analysis?

   • AFile hashes
   • BUser credentials
   • CNetwork traffic
   • DDNS records
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   During an investigation, an analyst identifies a suspicious domain that several infected hosts queried. The domain is not present in any internal threat intel feeds. The analyst wants to quickly determine if this domain is associated with known threat actors without leaving the FortiNDR Cloud console. What should the analyst do?

   • AReview the DNS resolution type for the domain in the packet capture.
   • BAdd the domain to a blocklist in the firewall policy.
   • CPerform a manual WHOIS lookup using an external web browser.
   • DSubmit the domain to the integrated VirusTotal integration for reputation analysis.
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   What does TTP stand for in the context of threat analysis?

   • ATactics, Techniques, and Procedures
   • BThreat, Target, and Protocol
   • CTime, Type, and Process
   • DTool, Trace, and Payload
   Reveal Solution Discussion Select an answer first