Fortinet Exam NSE5_FAZ-7.2 Topic 5 Question 29 Discussion

Actual exam question for Fortinet's NSE5_FAZ-7.2 exam

Question #: 29
Topic #: 5

[All NSE5_FAZ-7.2 Questions]

What happens when the IOC breach detection engine on FortiAnalyzer finds web logs that match a blocklisted IP address?

AThe endpoint is marked as Compromised and. optionally, can be put in quarantine.

BFortiAnalyzer flags the associated host for further analysis.

CA new Infected entry is added for the corresponding endpoint.

DThe detection engine classifies those logs as Suspicious

Show Suggested Answer

Suggested Answer: A

by Ona at Sep 16, 2024, 02:55 AM

Limited Time Offer

25%

Off

Get Premium NSE5_FAZ-7.2 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Jeannetta

2 months ago

Option C sounds like something a hacker would add to cover their tracks. I'm going with A or B for sure.

upvoted 0 times

...

Brittney

2 months ago

Haha, I bet the correct answer is 'D' just to mess with us. Security professionals love to throw in a curveball!

upvoted 0 times

...

Jacquline

2 months ago

I'm torn between Options A and B. Both seem valid, but I think quarantining the endpoint is the more proactive approach.

upvoted 0 times

...

Mel

2 months ago

I agree with Bettina. Quarantining the compromised endpoint is the logical course of action to mitigate the threat.

upvoted 0 times

Armando

6 days ago

C) A new Infected entry is added for the corresponding endpoint.

upvoted 0 times

...

Madonna

21 days ago

A) The endpoint is marked as Compromised and, optionally, can be put in quarantine.

upvoted 0 times

...

Elliott

23 days ago

A) The endpoint is marked as Compromised and, optionally, can be put in quarantine.

upvoted 0 times

...

Bobbye

25 days ago

B) FortiAnalyzer flags the associated host for further analysis.

upvoted 0 times

...

Stanford

26 days ago

B) FortiAnalyzer flags the associated host for further analysis.

upvoted 0 times

...

Cordelia

29 days ago

A) The endpoint is marked as Compromised and, optionally, can be put in quarantine.

upvoted 0 times

...

Stacey

1 months ago

A) The endpoint is marked as Compromised and, optionally, can be put in quarantine.

upvoted 0 times

...

Bettina

2 months ago

Option A seems like the most appropriate response. The IOC breach detection engine should be able to quarantine compromised endpoints to prevent further damage.

upvoted 0 times

Minna

28 days ago

User 3: Definitely, it helps prevent further damage.

upvoted 0 times

...

Sheldon

1 months ago

User 2: Agreed, quarantining compromised endpoints is crucial.

upvoted 0 times

...

Wilda

1 months ago

I think option A is the best choice.

upvoted 0 times

...

Germaine

2 months ago

Hmm, that makes sense too. It's important to analyze further before taking action.

upvoted 0 times

...

Billye

2 months ago

I disagree, I believe the correct answer is B) FortiAnalyzer flags the associated host for further analysis.

upvoted 0 times

...

Germaine

3 months ago

I think the answer is A) The endpoint is marked as Compromised and, optionally, can be put in quarantine.

upvoted 0 times

...