Perform Threat Hunting Activities NSE6-FORTINDR-CLOUD-ANALYST Practice Questions (Page 5)

Questions 21–21

1. 21application · medium

   A threat hunter is investigating a potential ransomware infection on a server. The hunter notices that the server's volume shadow copies have been deleted, and a ransom note has been placed on the desktop. Which additional indicator would be most useful to confirm the ransomware variant?

   • AThe total number of files encrypted
   • BThe file extension appended to encrypted files
   • CThe username of the logged-in user
   • DThe IP address of the server
   Reveal Solution Discussion Select an answer first