Fortinet NSE6_EDR_AD-7.0 - Fortinet NSE 6 - FortiEDR 7.0 Administrator Exam
Page: 2 / 7
Total 34 questions
Question #6 (Topic: Exam A)
You find third-party software on a user’s computer that does not appear in the application list on the communication control console.
Which two statements are true about this situation? (Choose two.)
Which two statements are true about this situation? (Choose two.)
A. The application has not made any connection attempts.
B. The application is allowed in all communication control policies.
C. The application is ignored because its reputation score is acceptable to the security policy.
D. The application is blocked by the security policies.
Answer: AB
Question #7 (Topic: Exam A)
A company requires a global exception for a FortiEDR multi-tenant environment.
Which recommendation must you make?
Which recommendation must you make?
A. Create a new exception and share it with other organizations.
B. Create a new exception and assign it globally to all organizations.
C. Create a separate exception policy for each organization hosted on FortiEDR.
D. Create a new exception and apply it to multiple organizations.
Answer: D
Question #8 (Topic: Exam A)
Refer to the exhibit.
You configured an execution prevention exclusion with both File Name = app.exe and Path = C:\Tools\.
What will FortiEDR do?
You configured an execution prevention exclusion with both File Name = app.exe and Path = C:\Tools\.
What will FortiEDR do?
A. Exclude app.exe whenever it appears.
B. Exclude all files in C:\Tools\.
C. Exclude only signed versions of app.exe.
D. Exclude only app.exe when it is running from C:\Tools\.
Answer: D
Question #9 (Topic: Exam A)
DRAG DROP
When implementing an application block policy in FortiEDR, which three actions, in order, reflect the correct operational sequence?
Select an action in the left column and hold and drag it to a blank position in the column on the right. Place the three correct actions in order, starting with the first action at the top of the column. After you place an action, you can move it again if you want to change your answer before proceeding to the next question. You must drop three actions in the work area.
Select and drag the screen divider to change the viewable area of the source and work areas.
When implementing an application block policy in FortiEDR, which three actions, in order, reflect the correct operational sequence?
Select an action in the left column and hold and drag it to a blank position in the column on the right. Place the three correct actions in order, starting with the first action at the top of the column. After you place an action, you can move it again if you want to change your answer before proceeding to the next question. You must drop three actions in the work area.
Select and drag the screen divider to change the viewable area of the source and work areas.
Answer: 
Question #10 (Topic: Exam A)
Refer to the exhibit.
An event exception is shown.
Which two statements about the exception are true? (Choose two.)
An event exception is shown.
Which two statements about the exception are true? (Choose two.)
A. FCS playbooks are enabled by Fortinet support.
B. The system owner can modify the trigger rules parameters.
C. A partial exception is applied to this event.
D. The exception is applied only on device C8092231196.
Answer: AD
