Perform Investigations to Detect Threats NSE6-FORTINDR-CLOUD-ANALYST Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   During an investigation, an analyst wants to enrich an alert with details about the affected user, device, and network. Which technique is used to collect this contextual information?

   • AOSINT integration
   • BTimeline creation
   • CContext gathering
   • DPacket capture analysis
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   Which DNS record type is used to map a domain name to an IPv6 address?

   • AA
   • BMX
   • CAAAA
   • DCNAME
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   What is the purpose of creating a timeline during an incident investigation?

   • ATo replace the need for packet capture
   • BTo encrypt investigation data
   • CTo reconstruct the sequence of activities
   • DTo automatically block malicious IPs
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   Which activity is an example of gathering contextual information about an affected asset during an investigation?

   • AExporting the alert as a PDF report
   • BLooking up the asset's owner, operating system, and recent login history
   • CCreating a new detection rule
   • DSetting a custom time range for the search
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   Which search setting in FortiNDR Cloud allows an analyst to include only specific telemetry sources, such as network or endpoint logs, in an investigation?

   • AField filter
   • BData source selection
   • CResult limit
   • DTime range
   Reveal Solution Discussion Select an answer first