Fortinet NSE6_EDR_AD-7.0 - Fortinet NSE 6 - FortiEDR 7.0 Administrator Exam
Page: 1 / 7
Total 34 questions
Question #1 (Topic: Exam A)
Which two statements correctly describe the IoT probing process on FortiEDR? (Choose two.)
A. Collectors running on servers are always used for IoT probing.
B. It identifies nearby devices by retrieving details such as hostname and IP address.
C. Only healthy collectors participate in IoT probing.
D. It captures all traffic from neighboring devices for deep packet inspection.
Answer: BC
Question #2 (Topic: Exam A)
What action does an on-premises reputation server take when it receives a hash request that is not found in its local database?
A. Automatically blocks applications with unknown hashes
B. Ignores them until manually updated
C. Requests the missing hashes from the cloud reputation service
D. Stores them locally and waits for endpoint input
Answer: C
Question #3 (Topic: Exam A)
A collector triggers a suspicious security incident that is initially flagged as potentially malicious.
The environment is connected to the FortiEDR Cloud Service (FCS) for classification.
How does FCS process the event for accurate classification?
The environment is connected to the FortiEDR Cloud Service (FCS) for classification.
How does FCS process the event for accurate classification?
A. By comparing the event against only local signatures
B. By correlating collector logs only
C. By relying solely on the FortiGate firewall policies
D. By data processing, comprehensive automated analysis, and comprehensive manual analysis
Answer: D
Question #4 (Topic: Exam A)
An employee leaves the company and no longer has access to the FortiEDR system. You must ensure GDPR compliance regarding the employee’s personal data stored in FortiEDR.
Which two data types must be removed to meet GDPR requirements? (Choose two.)
Which two data types must be removed to meet GDPR requirements? (Choose two.)
A. Installed applications
B. Installed OS name
C. Device and user name
D. IP address and MAC address
Answer: CD
Question #5 (Topic: Exam A)
Refer to the exhibit.
You are asked to block applications based on hash attributes.
Which two factors must you consider when applying the hash value? (Choose two.)
You are asked to block applications based on hash attributes.
Which two factors must you consider when applying the hash value? (Choose two.)
A. Hashes must follow supported formats.
B. Hashes must be used with at least one attribute, such as a filename or path.
C. Hashes must be unique to each application.
D. Hashes must be line-separated.
Answer: AC
