Fortinet FCSS_NST_SE-7.4 Exam Dumps and Practice Test Questions Set15 Q211-225
Visit here for our full Fortinet FCSS_NST_SE-7.4 exam dumps and practice test questions.
Question 211:
What role does monitoring for unusual satellite communication or VSAT traffic play in FortiNDR?
A) Satellite communications are outside network security scope
B) It identifies suspicious VSAT usage, unauthorized satellite connections, or satellite link exploitation suggesting remote location compromise or covert channels
C) Satellite protocols cannot be monitored
D) All satellite traffic is legitimate remote connectivity
Answer: B
Explanation:
FortiNDR identifies suspicious VSAT usage, unauthorized satellite connections, or satellite link exploitation suggesting remote location compromise or covert channels by monitoring satellite communication patterns for behaviors revealing malicious use of satellite links for data exfiltration, unauthorized communications, or compromise of remote facilities using satellite connectivity.
Satellite communication monitoring detects multiple threat patterns including detecting unauthorized VSAT connections suggesting rogue satellite installations, identifying unusual satellite traffic volumes indicating data exfiltration through satellite links, recognizing satellite link usage for covert channels bypassing terrestrial monitoring, detecting satellite terminal compromise through unusual communication patterns, identifying excessive satellite bandwidth consumption suggesting abuse, recognizing unusual satellite connection timing patterns, and detecting satellite communications to unexpected destinations. For example, detecting unauthorized VSAT terminal installation at remote facility communicating directly with external command infrastructure indicates covert channel establishment where attacker deploys satellite equipment to bypass corporate network monitoring exfiltrating data through unmonitored satellite link.
A is incorrect because enterprise satellite communications particularly at remote facilities require security monitoring for unauthorized usage and data exfiltration. C is incorrect because satellite protocols create observable traffic patterns including connection characteristics, volumes, and destinations enabling security monitoring. D is incorrect because satellite traffic can indicate unauthorized installations, covert channels, and data exfiltration requiring investigation.
Organizations using satellite communications should monitor VSAT usage for unauthorized connections and unusual patterns, maintain inventory of authorized satellite terminals and detect rogue installations, configure alerts for suspicious satellite traffic or unexpected destinations, implement satellite link security controls alongside monitoring, and investigate detected satellite anomalies as potential covert channels requiring immediate physical security review and terminal verification.
Question 212:
How does FortiNDR’s detection of unusual privacy-enhancing technology (PET) usage patterns contribute to security?
A) Privacy technologies are always used for legitimate privacy protection
B) It identifies suspicious anonymization network usage, unusual encrypted tunnel patterns, or PET abuse suggesting data exfiltration or command and control concealment
C) Privacy tools cannot indicate security threats
D) All encrypted privacy traffic is legitimate user privacy
Answer: B
Explanation:
FortiNDR identifies suspicious anonymization network usage, unusual encrypted tunnel patterns, or PET abuse suggesting data exfiltration or command and control concealment by monitoring privacy-enhancing technology traffic for patterns revealing malicious use of legitimate privacy tools to hide attack communications, exfiltrate data, or bypass security controls.
Privacy technology monitoring detects multiple threat patterns including detecting Tor usage from enterprise systems potentially hiding malicious communications, identifying unusual VPN tunnel patterns suggesting data exfiltration, recognizing privacy-focused DNS services used to bypass monitoring, detecting encrypted proxy usage evading security controls, identifying mix network communications potentially carrying command and control, recognizing unusual privacy tool deployments on sensitive systems, and detecting correlation between privacy technology usage and data theft indicators. For example, detecting database server establishing Tor connections followed by large outbound data transfers indicates data exfiltration where attacker uses anonymization network to hide stolen data transmission destination preventing threat intelligence and law enforcement attribution.
A is incorrect because privacy technologies can be abused for hiding malicious activities including data exfiltration and command and control communications. C is incorrect because privacy tool usage patterns particularly from unexpected systems or with unusual characteristics can indicate security threats. D is incorrect because encrypted privacy traffic can conceal data theft and attack communications requiring behavioral monitoring.
Organizations should monitor privacy-enhancing technology usage for suspicious patterns, implement policies governing legitimate privacy tool usage and detect violations, configure alerts for privacy technology on sensitive systems or with unusual patterns, recognize legitimate privacy needs while detecting abuse, and investigate detected privacy technology anomalies as potential data exfiltration or C2 concealment requiring immediate traffic analysis and source investigation.
Question 213:
What is the significance of detecting unusual software bill of materials (SBOM) access patterns in FortiNDR?
A) SBOM data contains only public component information
B) It identifies suspicious SBOM repository access, systematic component enumeration, or supply chain reconnaissance suggesting attack planning
C) SBOM access cannot reveal security threats
D) All component inventory access is legitimate asset management
Answer: B
Explanation:
FortiNDR identifies suspicious SBOM repository access, systematic component enumeration, or supply chain reconnaissance suggesting attack planning by monitoring software bill of materials access patterns and detecting behaviors revealing attackers gathering detailed component information to identify vulnerable dependencies for targeted supply chain attacks.
SBOM monitoring detects multiple threat patterns including detecting unauthorized SBOM repository access revealing application component details, identifying systematic SBOM enumeration suggesting vulnerability research, recognizing unusual SBOM query patterns characteristic of automated reconnaissance, detecting SBOM access immediately preceding targeted attacks, identifying credential abuse accessing component inventories, recognizing correlation between SBOM access and subsequent exploitation of discovered vulnerable components, and detecting competitive intelligence gathering through SBOM theft. For example, detecting external source accessing enterprise SBOM repository systematically downloading component inventories for all applications followed by targeted exploitation of discovered vulnerable libraries indicates supply chain reconnaissance where attacker uses SBOM data to identify specific vulnerable dependencies for precise attacks.
A is incorrect because SBOM data reveals detailed component versions and dependencies valuable for attackers planning targeted exploitation. C is incorrect because SBOM access patterns can indicate reconnaissance activities and supply chain attack planning. D is incorrect because component inventory access can reveal attack preparation when patterns suggest systematic vulnerability research or unauthorized enumeration.
Organizations maintaining SBOMs should monitor repository access for unusual patterns, implement strong authentication for SBOM access, configure alerts for systematic component enumeration or unauthorized SBOM queries, balance transparency benefits against reconnaissance risks, and investigate detected SBOM access anomalies as potential supply chain attack planning requiring enhanced vulnerability remediation and monitoring.
Question 214:
How does FortiNDR detect malicious use of legitimate robotic process automation (RPA) tools?
A) RPA tools are only used for authorized business automation
B) It identifies suspicious bot behaviors, unauthorized automation deployments, or RPA credential abuse suggesting automated attacks or data theft
C) Automation traffic cannot indicate security threats
D) All RPA activity is legitimate business process automation
Answer: B
Explanation:
FortiNDR identifies suspicious bot behaviors, unauthorized automation deployments, or RPA credential abuse suggesting automated attacks or data theft by monitoring robotic process automation communications and detecting patterns revealing malicious use of automation tools for systematic data exfiltration, credential abuse, or unauthorized business process manipulation.
RPA monitoring detects multiple threat patterns including detecting unauthorized RPA bot deployments automating malicious activities, identifying unusual automation patterns suggesting data exfiltration, recognizing RPA credential abuse enabling privileged access, detecting systematic data harvesting through automation tools, identifying unusual RPA execution frequencies or schedules, recognizing automation accessing unexpected resources, and detecting RPA tool deployment on compromised systems for attack automation. For example, detecting unauthorized RPA bot deployment systematically accessing customer databases and transferring data to external storage indicates automated data theft where attacker leverages automation tools to efficiently exfiltrate large volumes of sensitive information through systematic automated queries and transfers.
A is incorrect because RPA tools can be abused for automated attacks, data theft, and unauthorized automation requiring security monitoring. C is incorrect because automation traffic exhibits patterns revealing unauthorized deployments, suspicious behaviors, and data exfiltration. D is incorrect because RPA activity can indicate malicious automation when deployed without authorization or exhibiting suspicious access patterns.
Organizations using RPA should monitor automation tool usage for suspicious patterns, implement strong authentication and authorization for RPA deployments, configure alerts for unauthorized bot activities or unusual automation patterns, maintain inventory of approved RPA processes and detect rogue automations, and investigate detected RPA anomalies as potential automated attacks requiring immediate bot suspension and access review.
Question 215:
What role does detection of unusual cross-cloud resource access patterns play in FortiNDR multi-cloud security?
A) Cross-cloud access is always authorized hybrid cloud operations
B) It identifies suspicious multi-cloud API usage, unauthorized cross-cloud data transfers, or credential abuse spanning cloud providers
C) Multi-cloud traffic cannot be distinguished from single-cloud usage
D) All cross-cloud access is legitimate hybrid architecture
Answer: B
Explanation:
FortiNDR identifies suspicious multi-cloud API usage, unauthorized cross-cloud data transfers, or credential abuse spanning cloud providers by monitoring cross-cloud communications and detecting patterns revealing attacks leveraging multi-cloud complexity for data exfiltration, lateral movement between cloud providers, or credential abuse across hybrid infrastructure.
Cross-cloud monitoring detects multiple threat patterns including detecting unauthorized data transfers between different cloud providers, identifying unusual cross-cloud API access patterns suggesting reconnaissance, recognizing credential abuse accessing resources across multiple clouds, detecting lateral movement from one cloud provider to another, identifying data exfiltration through cross-cloud synchronization, recognizing unusual cross-cloud networking or peering, and detecting multi-cloud privilege escalation. For example, detecting compromised credentials accessing AWS infrastructure to enumerate resources then transferring discovered data to attacker-controlled Azure storage indicates cross-cloud data exfiltration where attacker leverages multi-cloud complexity and separate security monitoring to hide data theft spanning cloud providers.
A is incorrect because cross-cloud access can indicate data exfiltration and lateral movement requiring monitoring beyond assuming all access is authorized operations. C is incorrect because multi-cloud traffic exhibits distinctive patterns including cross-provider API calls and data transfers observable through traffic analysis. D is incorrect because cross-cloud access can reveal attacks exploiting multi-cloud complexity for data theft and credential abuse.
Organizations with multi-cloud should monitor cross-cloud resource access for suspicious patterns, implement unified authentication and authorization across cloud providers, configure alerts for unusual cross-cloud data transfers or API usage, establish baselines for legitimate cross-cloud operations, and investigate detected cross-cloud anomalies as potential data exfiltration requiring immediate credential rotation across all cloud providers.
Question 216:
How does FortiNDR’s detection of unusual network function virtualization (NFV) or service function chaining patterns enhance infrastructure security?
A) NFV traffic is purely operational infrastructure
B) It identifies suspicious virtual network function behaviors, unauthorized service chain modifications, or NFV infrastructure compromise
C) Virtualized network functions cannot be exploited
D) Service chaining provides no security indicators
Answer: B
Explanation:
FortiNDR identifies suspicious virtual network function behaviors, unauthorized service chain modifications, or NFV infrastructure compromise by monitoring network function virtualization communications and detecting patterns revealing attacks targeting virtualized network infrastructure for traffic manipulation, service disruption, or data interception.
NFV monitoring detects multiple threat patterns including detecting unauthorized virtual network function deployments introducing malicious services, identifying suspicious service chain modifications potentially redirecting traffic, recognizing NFV orchestration compromise enabling infrastructure manipulation, detecting unusual virtual function behaviors suggesting compromise, identifying unauthorized access to NFV management and orchestration systems, recognizing traffic steering manipulation for man-in-the-middle attacks, and detecting resource exhaustion through malicious VNF deployment. For example, detecting unauthorized modification to service function chain inserting malicious virtual firewall that logs then forwards traffic indicates NFV compromise where attacker manipulates virtualized network infrastructure to intercept all traffic flowing through compromised service chain for surveillance and data theft.
A is incorrect because NFV infrastructure has security implications with compromise enabling traffic interception and service manipulation. C is incorrect because virtualized network functions can be exploited through vulnerabilities, orchestration compromise, and service chain manipulation. D is incorrect because service chaining patterns provide security indicators revealing unauthorized modifications and infrastructure compromise.
Organizations deploying NFV should monitor virtual network function behaviors and service chain modifications, implement strong authentication for NFV orchestration systems, configure alerts for unauthorized VNF deployments or service chain changes, establish baselines for legitimate NFV operations, and investigate detected NFV anomalies as potential infrastructure compromise requiring immediate service chain review and VNF integrity verification.
Question 217:
What is the importance of detecting unusual biometric authentication system communications in FortiNDR?
A) Biometric systems are secure and require no monitoring
B) It identifies suspicious biometric template access, authentication bypass attempts, or biometric infrastructure compromise suggesting identity system attacks
C) Biometric traffic cannot reveal security threats
D) All biometric authentication is legitimate user verification
Answer: B
Explanation:
FortiNDR identifies suspicious biometric template access, authentication bypass attempts, or biometric infrastructure compromise suggesting identity system attacks by monitoring biometric authentication communications for patterns revealing attacks targeting biometric systems for template theft, authentication bypass, or presentation attacks.
Biometric monitoring detects multiple threat patterns including detecting unauthorized access to biometric template databases potentially enabling template theft, identifying unusual biometric authentication patterns suggesting spoofing or presentation attacks, recognizing biometric system exploitation attempts, detecting unusual failure rates indicating attack attempts, identifying biometric enrollment anomalies, recognizing template database exfiltration, and detecting correlation between biometric system access and identity theft. For example, detecting unauthorized access to biometric template storage followed by unusual authentication successes from previously rejected users indicates biometric compromise where attacker steals templates to create spoofed biometric credentials bypassing authentication through presentation attacks using stolen template data.
A is incorrect because biometric systems can be compromised through template theft, spoofing, and infrastructure attacks requiring security monitoring. C is incorrect because biometric traffic exhibits patterns revealing authentication anomalies, unauthorized template access, and system compromise. D is incorrect because biometric authentication can indicate spoofing attacks, template theft, and system compromise when patterns suggest malicious activities.
Organizations using biometric authentication should monitor biometric system communications for unusual patterns, implement strong protection for biometric templates including encryption and secure storage, configure alerts for unauthorized template access or unusual authentication patterns, establish baselines for normal biometric usage, and investigate detected biometric anomalies as potential identity system compromise requiring immediate template database review and potential re-enrollment.
Question 218:
How does FortiNDR detect abuse of legitimate threat intelligence sharing platforms?
A) Threat intelligence platforms only share security information
B) It identifies suspicious intelligence queries, unauthorized indicator access, or platform abuse suggesting competitive intelligence gathering or reconnaissance
C) Intelligence sharing traffic cannot indicate threats
D) All threat intelligence access is legitimate security research
Answer: B
Explanation:
FortiNDR identifies suspicious intelligence queries, unauthorized indicator access, or platform abuse suggesting competitive intelligence gathering or reconnaissance by monitoring threat intelligence platform communications and detecting patterns revealing malicious use of intelligence sharing for gathering information about organizations’ security posture, incidents, or vulnerabilities.
Threat intelligence monitoring detects multiple threat patterns including detecting systematic threat intelligence queries targeting specific organizations suggesting competitive intelligence, identifying unusual intelligence platform access patterns, recognizing intelligence data exfiltration or scraping, detecting credential abuse for intelligence platform access, identifying queries revealing organizational security incidents or vulnerabilities, recognizing correlation between intelligence gathering and subsequent targeted attacks, and detecting intelligence platform compromise. For example, detecting competitor systematically querying threat intelligence platforms for all indicators and reports associated with target organization indicates competitive intelligence gathering where adversary uses intelligence sharing platforms to discover security incidents, vulnerabilities, and defensive capabilities for competitive advantage or targeted attack planning.
A is incorrect because threat intelligence platforms can be abused for competitive intelligence gathering and reconnaissance beyond legitimate security information sharing. C is incorrect because intelligence sharing traffic exhibits patterns revealing systematic organizational targeting and intelligence gathering. D is incorrect because threat intelligence access can indicate competitive intelligence or attack reconnaissance when patterns suggest systematic organizational targeting.
Organizations sharing threat intelligence should monitor platform usage for suspicious targeting patterns, implement access controls limiting intelligence visibility where appropriate, configure alerts for systematic queries targeting specific organizations, balance intelligence sharing benefits against reconnaissance risks, and investigate detected intelligence platform anomalies as potential competitive intelligence or reconnaissance requiring intelligence sharing policy review.
Question 219:
What role does monitoring for unusual neural interface or brain-computer interface communications play in FortiNDR emerging technology security?
A) Neural interfaces are experimental technology unrelated to enterprise security
B) It identifies suspicious BCI device communications, unauthorized neural data access, or interface compromise suggesting sensitive cognitive data theft
C) Neural interface traffic cannot be monitored
D) All BCI communications are legitimate medical or research usage
Answer: B
Explanation:
FortiNDR identifies suspicious BCI device communications, unauthorized neural data access, or interface compromise suggesting sensitive cognitive data theft by monitoring brain-computer interface communications for patterns revealing attacks targeting neural interface devices for cognitive data exfiltration, device compromise, or unauthorized access to sensitive neural information.
Neural interface monitoring detects multiple threat patterns including detecting unauthorized access to neural interface data potentially revealing cognitive information, identifying suspicious BCI device communications suggesting compromise, recognizing unusual neural data transfers potentially exfiltrating sensitive cognitive patterns, detecting neural interface exploitation attempts, identifying unauthorized BCI device connections, recognizing cognitive data theft through interface compromise, and detecting privacy violations through excessive neural data collection. For example, detecting compromised neural interface device transmitting raw neural signals to external servers indicates cognitive data theft where attacker exploits BCI device to exfiltrate sensitive neural data potentially revealing thoughts, intentions, or cognitive patterns representing extreme privacy violation.
A is incorrect because neural interfaces increasingly enter enterprise environments for accessibility and productivity requiring security monitoring as technology matures. C is incorrect because neural interface devices create network communications observable for security monitoring of data access and device behaviors. D is incorrect because BCI communications can indicate device compromise and unauthorized cognitive data access requiring security oversight.
Organizations deploying neural interfaces should monitor BCI device communications for unauthorized access and unusual patterns, implement strong data protection for neural interface information, configure alerts for suspicious neural data transfers or device compromise, establish strict privacy controls for cognitive data, and investigate detected neural interface anomalies as potential cognitive data theft requiring immediate device isolation and privacy impact assessment.
Question 220:
How does FortiNDR’s detection of unusual mesh network routing changes contribute to distributed infrastructure security?
A) Mesh networks are self-organizing and require no security monitoring
B) It identifies suspicious routing modifications, mesh network attacks, or node compromise suggesting infrastructure manipulation or traffic interception
C) Mesh routing cannot be exploited
D) All routing changes are legitimate network optimization
Answer: B
Explanation:
FortiNDR identifies suspicious routing modifications, mesh network attacks, or node compromise suggesting infrastructure manipulation or traffic interception by monitoring mesh network routing behaviors and detecting patterns revealing attacks targeting distributed mesh infrastructure for traffic manipulation, denial of service, or selective routing for interception.
Mesh network monitoring detects multiple threat patterns including detecting unauthorized mesh routing changes potentially enabling traffic interception, identifying mesh node compromise through unusual routing behaviors, recognizing selective forwarding attacks where compromised nodes drop specific traffic, detecting wormhole attacks creating artificial routing shortcuts, identifying Sybil attacks where single node presents multiple identities, recognizing routing table poisoning introducing malicious routes, and detecting mesh network partitioning through deliberate routing manipulation. For example, detecting compromised mesh node announcing itself as optimal route for all destinations then selectively forwarding or modifying traffic indicates mesh network attack where attacker positions compromised node as man-in-the-middle intercepting and potentially manipulating all communications flowing through mesh infrastructure.
A is incorrect because mesh networks despite self-organizing capabilities can be attacked through routing manipulation and node compromise requiring security monitoring. C is incorrect because mesh routing can be exploited through various attacks including selective forwarding, wormhole attacks, and routing poisoning. D is incorrect because routing changes can indicate attacks manipulating traffic flows for interception or denial of service.
Organizations deploying mesh networks should monitor routing behaviors for suspicious modifications, implement secure routing protocols with authentication, configure alerts for unusual routing changes or node behaviors, establish baselines for normal mesh routing patterns, and investigate detected mesh anomalies as potential infrastructure attacks requiring immediate compromised node isolation and routing verification.
Question 221:
What is the significance of detecting unusual software-defined wide area network (SD-WAN) policy violations in FortiNDR?
A) SD-WAN policies are automatically enforced
B) It identifies suspicious traffic steering, unauthorized path selection, or policy bypass suggesting SD-WAN infrastructure compromise or configuration exploitation
C) SD-WAN traffic cannot indicate security threats
D) All WAN traffic follows defined policies
Answer: B
Explanation:
FortiNDR identifies suspicious traffic steering, unauthorized path selection, or policy bypass suggesting SD-WAN infrastructure compromise or configuration exploitation by monitoring SD-WAN communications for patterns revealing attacks manipulating software-defined WAN policies for traffic interception, policy evasion, or infrastructure compromise.
SD-WAN monitoring detects multiple threat patterns including detecting traffic steering violations suggesting policy bypass, identifying unauthorized path selections potentially routing through attacker infrastructure, recognizing SD-WAN controller compromise enabling infrastructure manipulation, detecting unusual application routing decisions, identifying overlay tunnel manipulation, recognizing unauthorized WAN edge deployments, and detecting SD-WAN orchestration credential abuse. For example, detecting SD-WAN policy modifications routing specific application traffic through unexpected paths or unauthorized VPN tunnels indicates infrastructure compromise where attacker manipulates software-defined WAN to redirect sensitive traffic through attacker-controlled infrastructure enabling interception and data theft.
A is incorrect because SD-WAN policies can be bypassed through infrastructure compromise or configuration exploitation requiring monitoring. C is incorrect because SD-WAN traffic exhibits patterns revealing policy violations, unauthorized routing, and infrastructure compromise. D is incorrect because WAN traffic can violate policies through attacks, misconfigurations, or infrastructure compromise requiring detection.
Organizations deploying SD-WAN should monitor for policy violations and unusual traffic steering, implement strong authentication for SD-WAN orchestration, configure alerts for unexpected path selections or policy changes, establish baselines for legitimate SD-WAN routing patterns, and investigate detected SD-WAN anomalies as potential infrastructure compromise requiring immediate controller review and policy verification.
Question 222:
How does FortiNDR detect malicious use of legitimate data loss prevention (DLP) systems?
A) DLP systems prevent all data exfiltration automatically
B) It identifies suspicious DLP policy modifications, monitoring evasion techniques, or DLP infrastructure compromise suggesting data protection bypass
C) DLP traffic cannot be exploited
D) All DLP exceptions are legitimate business requirements
Answer: B
Explanation:
FortiNDR identifies suspicious DLP policy modifications, monitoring evasion techniques, or DLP infrastructure compromise suggesting data protection bypass by monitoring DLP system communications and detecting patterns revealing attacks targeting data loss prevention infrastructure to disable protections, create exceptions, or evade monitoring for data exfiltration.
DLP monitoring detects multiple threat patterns including detecting unauthorized DLP policy modifications creating exceptions for data exfiltration, identifying unusual DLP system access suggesting infrastructure compromise, recognizing systematic DLP bypass attempts, detecting credential abuse modifying data protection rules, identifying DLP agent tampering or disabling, recognizing correlation between DLP policy changes and data theft, and detecting DLP infrastructure compromise enabling unrestricted exfiltration. For example, detecting compromised administrator credentials modifying DLP policies to exclude specific file types or destinations immediately before large data transfers indicates DLP bypass where attacker manipulates data protection infrastructure to create exfiltration channels avoiding detection and prevention controls.
A is incorrect because DLP systems can be compromised, bypassed, or manipulated requiring monitoring to detect protection evasion. C is incorrect because DLP infrastructure can be exploited through policy manipulation, credential abuse, and system compromise. D is incorrect because DLP exceptions can indicate malicious policy modification when created without proper authorization or immediately before data theft.
Organizations deploying DLP should monitor for unauthorized policy modifications and system access, implement strong authentication and change approval for DLP configuration, configure alerts for DLP policy changes or systematic bypass attempts, establish baselines for legitimate DLP exceptions, and investigate detected DLP anomalies as potential data protection bypass requiring immediate policy restoration and data transfer investigation.
Question 223:
What role does detection of unusual programmable logic controller (PLC) communications play in FortiNDR industrial security?
A) PLCs only communicate with authorized control systems
B) It identifies suspicious PLC programming, unauthorized control commands, or OT device compromise suggesting industrial process manipulation
C) PLC protocols are proprietary and cannot be monitored
D) All PLC communications are legitimate automation
Answer: B
Explanation:
FortiNDR identifies suspicious PLC programming, unauthorized control commands, or OT device compromise suggesting industrial process manipulation by monitoring programmable logic controller communications for patterns revealing attacks targeting industrial automation for sabotage, production disruption, or safety system compromise.
PLC monitoring detects multiple threat patterns including detecting unauthorized PLC programming or logic modifications, identifying unusual control commands suggesting malicious process manipulation, recognizing PLC compromise through abnormal communication patterns, detecting unauthorized engineering workstation connections, identifying unusual PLC data access potentially exfiltrating process information, recognizing timing or sequencing anomalies in control logic, and detecting correlation between PLC communications and process safety incidents. For example, detecting unauthorized engineering workstation uploading modified control logic to safety-critical PLC then issuing commands that disable safety interlocks indicates industrial sabotage where attacker compromises programmable logic controller to manipulate industrial processes causing safety incidents or production disruption.
A is incorrect because PLCs can be accessed by attackers through compromised engineering workstations or network access requiring security monitoring. C is incorrect because PLC protocols despite some proprietary elements create observable traffic patterns revealing programming activities and control commands. D is incorrect because PLC communications can indicate malicious programming, unauthorized commands, and process manipulation requiring investigation.
Organizations with industrial automation should monitor PLC communications for unauthorized programming and suspicious commands, implement network segmentation isolating control systems, configure alerts for unusual PLC access or programming activities, establish baselines for legitimate PLC operations, and investigate detected PLC anomalies as potential industrial sabotage requiring immediate operational review and safety system verification.
Question 224:
How does FortiNDR’s detection of unusual homomorphic encryption or confidential computing patterns contribute to privacy-preserving computation security?
A) Encrypted computation is inherently secure
B) It identifies suspicious encrypted processing requests, unusual confidential compute usage, or privacy technology abuse suggesting data theft or computation manipulation
C) Homomorphic encryption cannot be monitored
D) All privacy-preserving computation is legitimate data protection
Answer: B
Explanation:
FortiNDR identifies suspicious encrypted processing requests, unusual confidential compute usage, or privacy technology abuse suggesting data theft or computation manipulation by monitoring privacy-preserving computation systems for patterns revealing attacks targeting homomorphic encryption or confidential computing infrastructure for unauthorized data processing, result manipulation, or encryption system compromise. For example, detecting unauthorized access to confidential computing infrastructure processing encrypted sensitive data then exfiltrating computation results or encrypted data indicates privacy system compromise where attacker exploits secure computation environment to access data intended to remain encrypted throughout processing lifecycle.
A is incorrect because encrypted computation systems can be compromised through infrastructure attacks, result manipulation, and unauthorized access requiring security monitoring. C is incorrect because homomorphic encryption systems create observable request patterns, resource usage, and communication behaviors enabling security monitoring. D is incorrect because privacy-preserving computation can indicate unauthorized data processing or system abuse when usage patterns suggest malicious activities.
Organizations using privacy-preserving computation should monitor encrypted processing systems for unusual patterns, implement strong authentication for confidential computing access, configure alerts for suspicious computation requests or excessive usage, establish baselines for legitimate encrypted processing, and investigate detected privacy computation anomalies as potential data theft requiring immediate system access review and result verification.
Question 225:
What is the importance of detecting unusual decentralized identity and verifiable credential usage in FortiNDR?
A) Decentralized identity is inherently trustworthy
B) It identifies suspicious credential verification patterns, identity system exploitation, or verifiable credential forgery suggesting advanced identity attacks
C) Decentralized credentials cannot be monitored
D) All verifiable credential usage is legitimate authentication
Answer: B
Explanation:
FortiNDR identifies suspicious credential verification patterns, identity system exploitation, or verifiable credential forgery suggesting advanced identity attacks by monitoring decentralized identity and verifiable credential systems for patterns revealing attacks targeting self-sovereign identity infrastructure for credential forgery, verification bypass, or identity theft.
Decentralized identity monitoring detects multiple threat patterns including detecting suspicious verifiable credential presentations suggesting forgery, identifying unusual credential verification patterns, recognizing decentralized identifier compromise through abnormal usage, detecting unauthorized credential issuance, identifying credential revocation evasion attempts, recognizing distributed ledger manipulation affecting identity records, and detecting correlation between suspicious credentials and unauthorized access. For example, detecting forged verifiable credentials with invalid cryptographic signatures being presented for authentication or unusual patterns in distributed identifier resolution indicates decentralized identity attack where attacker attempts to forge credentials or manipulate identity verification bypassing self-sovereign identity protections for unauthorized access.
A is incorrect because decentralized identity systems can be attacked through credential forgery, verification bypass, and infrastructure compromise requiring security monitoring. C is incorrect because decentralized credentials create verification requests, ledger interactions, and usage patterns observable through traffic analysis. D is incorrect because verifiable credential usage can indicate forgery attempts and identity system exploitation when patterns reveal suspicious verification or credential anomalies.
Organizations implementing decentralized identity should monitor credential verification patterns for suspicious activities, implement robust cryptographic verification for credentials, configure alerts for unusual credential usage or verification anomalies, establish baselines for legitimate decentralized identity patterns, and investigate detected credential anomalies as potential advanced identity attacks requiring immediate verification infrastructure review and potential credential revocation.