Perform Investigations to Detect Threats NSE6-FORTINDR-CLOUD-ANALYST Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   Which scenario would most likely require an outbreak investigation workflow?

   • AMultiple hosts infected with the same malware strain
   • BA routine software update
   • CA user requesting password reset
   • DA single false positive alert
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   An alert indicates a host is beaconing to an external IP. The analyst has the packet capture (PCAP) for the relevant time window. What should the analyst look for in the PCAP to confirm the beaconing behavior?

   • AAn ARP request from the host to the gateway.
   • BMultiple DNS queries for various legitimate domains.
   • CA single large file transfer to the destination IP.
   • DA consistent, periodic pattern of small outbound packets to the same destination IP.
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   What is the primary purpose of the VirusTotal integration in FortiNDR Cloud?

   • ATo block all incoming network traffic
   • BTo replace the need for endpoint detection
   • CTo encrypt sensitive data at rest
   • DTo check files, URLs, and domains against known malicious indicators
   Reveal Solution Discussion Select an answer first
5. 19foundation · easy

   Which tool or integration is commonly used to investigate a file hash for known malicious indicators?

   • ADNS resolver
   • BTimeline viewer
   • CPacket capture analyzer
   • DVirusTotal
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   What is the primary purpose of investigating a file hash during a threat investigation?

   • ATo encrypt the file
   • BTo identify malware and correlate with threat intelligence
   • CTo recover deleted files
   • DTo determine the file's creation date
   Reveal Solution Discussion Select an answer first