NSE 6 - FortiEDR 7.0 Administrator Practice Questions & Answers • ExamPrepare

17 questions in this view

Page 1 of 3

Question 1

Refer to the exhibit. Based on the event shown

Refer to the exhibit.

Based on the event shown in the exhibit, which two statements about the event are true? (Choose two.)

The user was able to launch TestApplication.exe .
The event is marked as Handled .
TestApplication.exe is sophisticated malware.
FCS classified the event as malicious.

Select an answer above, then submit your vote. Reading or practicing does not cast a vote.

Question 2

You find third-party software on a user’s computer that does not appear in the application list on the communication control console.

Which two statements are true about this situation? (Choose two.)

The application is allowed in all communication control policies.
The application has not made any connection attempts.
The application is ignored because its reputation score is acceptable to the security policy.
The application is blocked by the security policies.

Select an answer above, then submit your vote. Reading or practicing does not cast a vote.

Question 3

Refer to the exhibits.

What happens when the net user command runs on an endpoint?

Query configuration

CLI output

It triggers FortiEDR rules because the activity is not suspicious.
It triggers an incident when the query matches the target process ( net.exe ).
It blocks CLI commands by default.
It triggers an immediate endpoint alert.

Select an answer above, then submit your vote. Reading or practicing does not cast a vote.

Question 4

You are asked to create a playbook to isolate a device with a collector.

Which action category does isolating a device with a collector fall under?

Custom
Notifications
Investigation
Remediation

Select an answer above, then submit your vote. Reading or practicing does not cast a vote.

Question 5

Refer to the exhibit.

Based on the exhibit, which statement about this threat hunting query is true?

Threat hunting query

The query is configured as a global hunting rule and is automatically visible across all organizations.
RDP connections will be automatically blocked and classified as suspicious.
The query is limited to detecting network activity and does not inspect process behavior.
A security incident will be generated whenever the device attempts an RDP connection.

Select an answer above, then submit your vote. Reading or practicing does not cast a vote.

Question 6

A collector triggers a suspicious security incident that is initially flagged as potentially malicious.

The environment is connected to the FortiEDR Cloud Service (FCS) for classification.

How does FCS process the event for accurate classification?

By comparing the event against only local signatures
By data processing, comprehensive automated analysis, and comprehensive manual analysis
By correlating collector logs only
By relying solely on the FortiGate firewall policies

Select an answer above, then submit your vote. Reading or practicing does not cast a vote.