Fortinet NSE5_EDR-5.0 - Fortinet NSE 5 - FortiEDR 5.0 Exam
Page: 3 / 9
Total 44 questions
Question #11 (Topic: Exam A)
What is the role of a collector in the communication control policy?
A. A collector is used to change the reputation score of any application that collector runs
B. A collector can quarantine unsafe applications from communicating
C. A collector blocks unsafe applications from running
D. A collector records applications that communicate externally
Answer: B
Question #12 (Topic: Exam A)
A company requires a global communication policy for a FortiEDR multi-tenant environment.
How can the administrator achieve this?
How can the administrator achieve this?
A. An administrator creates a new communication control policy and shares it with other organizations.
B. A local administrator creates a new communication control policy and shares it with other organizations.
C. An administrator creates a new communication control policy for each organization.
D. A local administrator creates a new communication control policy and assigns it globally to all organizations.
Answer: C
Question #13 (Topic: Exam A)
Based on the forensics data shown in the exhibit, which two statements are true? (Choose two.)
A. An exception has been created for this event.
B. The device has been isolated.
C. The exfiltration prevention policy has blocked this event.
D. The forensics data is displayed in the stacks view.
Answer: AD
Question #14 (Topic: Exam A)
What is the benefit of using file hash along with the file name in a threat hunting repository search?
A. It helps to check the malware even if the malware variant uses a different file name.
B. It helps to make sure the hash is really a malware.
C. It helps to find if some instances of the hash are actually associated with a different file.
D. It helps locate a file as threat hunting only allows hash search.
Answer: A
Question #15 (Topic: Exam A)
A FortiEDR security event is causing a performance issue with a third-party application.
What must you do first about the event?
What must you do first about the event?
A. Investigate the event to verify whether or not the application is safe
B. Contact Fortinet support
C. Terminate the process and uninstall the third-party application
D. Immediately create an exception
Answer: A
