Perform Threat Hunting Activities NSE6-FORTINDR-CLOUD-ANALYST Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A security analyst is reviewing a series of alerts about a user account that has been sending large volumes of email to internal recipients. The emails contain links to a file-sharing site. The analyst notices that the user recently clicked a link in a phishing email. Which threat hunting approach would be most effective to determine if this is a coordinated campaign targeting other users?

   • AReview the user's email login history for impossible travel patterns
   • BSearch for other users who clicked the same link or visited the same file-sharing domain
   • CIsolate the user's machine and wait for additional alerts
   • DCheck if the user's machine has any new scheduled tasks
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A threat hunter is investigating a series of alerts that show a user account has been used to log in from multiple geographic locations within a short time frame. The user is a high-privilege administrator. The hunter must determine if this is a compromised account or a legitimate use of a VPN. Which approach would be most effective?

   • AImmediately disable the user account and reset the password
   • BSearch for other users who have logged in from the same locations
   • CCorrelate the login times with the user's known travel schedule and VPN usage logs
   • DBlock the IP addresses associated with the logins
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   A threat hunter is planning a proactive search for malicious activity. Which approach is characterized by forming a hypothesis based on observed anomalies or threat intelligence, then actively searching for evidence to confirm or refute that hypothesis?

   • ALog aggregation
   • BIncident response
   • CHypothesis-driven hunting
   • DVulnerability scanning
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A threat hunter is investigating a potential ransomware incident. The hunter observes that a process is attempting to access the Windows registry key HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest. Which ransomware behavior does this indicate?

   • AAttempting to delete volume shadow copies
   • BAttempting to enumerate files on the system for encryption
   • CAttempting to disable security features or tamper with authentication mechanisms
   • DAttempting to communicate with a command-and-control server
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   During a ransomware investigation, a threat hunter observes a large number of files being renamed with a new extension and a ransom note being dropped in multiple directories. Which ransomware behavior is this most indicative of?

   • AFile encryption
   • BData exfiltration
   • CLateral movement
   • DCommand and control
   Reveal Solution Discussion Select an answer first