Prepare for your exam certification with our NSE5_EDR-5.0 Certified Fortinet [Q17-Q39]

Q17. Exhibit.

Based on the event shown in the exhibit which two statements about the event are true? (Choose two.)

The device is moved to isolation.

Playbooks is configured for this event.

The event has been blocked

The policy is in simulation mode

Q18. What is the role of a collector in the communication control policy?

A collector blocks unsafe applications from running

A collector is used to change the reputation score of any application that collector runs

A collector records applications that communicate externally

A collector can quarantine unsafe applications from communicating

Q19. Refer to the exhibit.

Based on the FortiEDR status output shown in the exhibit, which two statements about the FortiEDR collector are true? (Choose two.)

The collector device has windows firewall enabled

The collector has been installed with an incorrect port number

The collector has been installed with an incorrect registration password

The collector device cannot reach the central manager

Q20. Refer to the exhibits.

The exhibits show application policy logs and application details Collector C8092231196 is a member of the Finance group What must an administrator do to block the FileZilia application?

Deny application in Finance policy

Assign Finance policy to DBA group

Assign Finance policy to Default Collector Group

Assign Simulation Communication Control Policy to DBA group

Q21. Which connectors can you use for the FortiEDR automated incident response? (Choose two.)

FortiNAC

FortiGate

FortiSiem

FortiSandbox

Q22. Exhibit.

Based on the forensics data shown in the exhibit, which two statements are true? (Choose two.)

An exception has been created for this event

The forensics data is displayed m the stacks view

The device has been isolated

The exfiltration prevention policy has blocked this event

Q23. A company requires a global communication policy for a FortiEDR multi-tenant environment.
How can the administrator achieve this?

An administrator creates a new communication control policy and shares it with other organizations

A local administrator creates new a communication control policy and shares it with other organizations

A local administrator creates a new communication control policy and assigns it globally to all organizations

An administrator creates a new communication control policy for each organization

Q24. Which two statements are true about the remediation function in the threat hunting module? (Choose two.)

The file is removed from the affected collectors

The threat hunting module sends the user a notification to delete the file

The file is quarantined

The threat hunting module deletes files from collectors that are currently online.

Q25. Which FortiEDR component is required to find malicious files on the entire network of an organization?

FortiEDR Aggregator

FortiEDR Central Manager

FortiEDR Threat Hunting Repository

FortiEDR Core

Q26. What is the benefit of using file hash along with the file name in a threat hunting repository search?

It helps to make sure the hash is really a malware

It helps to check the malware even if the malware variant uses a different file name

It helps to find if some instances of the hash are actually associated with a different file

It helps locate a file as threat hunting only allows hash search

Q27. Which two statements about the FortiEDR solution are true? (Choose two.)

It provides pre-infection and post-infection protection

It is Windows OS only

It provides central management

It provides pant-to-point protection

Q28. Exhibit.

Based on the forensics data shown in the exhibit which two statements are true? (Choose two.)

The device cannot be remediated

The event was blocked because the certificate is unsigned

Device C8092231196 has been isolated

The execution prevention policy has blocked this event.

Prepare for your exam certification with our NSE5_EDR-5.0 Certified Fortinet [Q17-Q39]

Be the first to reply

Leave a Reply Cancel reply