nse5_faz-72 Exam - Question 25

Question

What happens when the IOC breach detection engine on FortiAnalyzer finds web logs that match a blocklisted IP address?

Examice · Accepted Answer

When the IOC breach detection engine on FortiAnalyzer finds web logs that match a blocklisted IP address, a new Infected entry is added for the corresponding endpoint.

r_jordan · Answer

C is correct

Alexh07 · Answer

Answer Correct is C

In FortiAnalyzer Analyst 7.2 Study Guide, p. 73 "The breach detection engine on FortiAnalyzer uses Fortiguard Threat DEtection Service (TDS) intelligence to analyze web filter logs for breach detection...When the threat match is found, a threat score is given to the end user based on the overall ranking score from TDS"

paytenj10 · Answer

If a match is found in the blacklist, then FortiAnalyzer displays the endpoint in Compromised Hosts with a Verdict of Infected.

The answer is C

Thomas_2020 · Answer

C correct

LAFNELL · Answer

C is correct

rian00z_ · Answer

C is correct

nse5_faz-72 Exam - Question 25

Discussion