Practice Free NSE6_EDR_AD-7.0 Exam Online Questions
Refer to the exhibit.
Based on the threat hunting event details shown in the exhibit, which two statements about the event are true? (Choose two.)
- A . The user Fortinet has executed a ping command.
- B . The activity event is associated with the file action.
- C . There are no MITRE details available for this event
- D . The PING.EXE process was blocked.
Which two Python commands are supported when using FortiEDR Connect to directly access a protected device shell? (Choose two.)
- A . %timestamp
- B . %psexec
- C . %upload_file
- D . %ipconfig_all
Refer to the exhibit.
Based on the FortiEDR status output shown in the exhibit, what are two reasons for the degraded state? (Choose two.)
- A . The endpoint cannot reach the central manager.
- B . The collector is installed with an incorrect registration password.
- C . The endpoint has windows firewall enabled.
- D . The collector is installed with an incorrect port number.
An employee leaves the company and no longer has access to the FortiEDR system. You must ensure GDPR compliance regarding the employee’s personal data stored in FortiEDR.
Which two data types must be removed to meet GDPR requirements? (Choose two.)
- A . Installed applications
- B . Installed OS name
- C . Device and user name
- D . IP address and MAC address
Refer to the exhibits.
You are attempting to move a collector into the High Security Collector Group for isolation but encounter an error in the API request as shown on the exhibit.
To successfully isolate the collector, which API parameter must you correct?
- A . Update the authorization credentials in the API header.
- B . Set the target collector group parameter to Engineering group.
- C . Set the organization parameter to Default
- D . Change the HTTP method in the request from PUT to POST.
Refer to the exhibit
Based on the incident details shown in the exhibit, which two statements about this incident are true? (Choose two.)
- A . The incident has already been fully handled.
- B . The incident occurred on only one device.
- C . The destination IP address is blocked by FortiGate.
- D . The incident is classified by the FortiEDR Core.
You find third-party software on a user’s computer that does not appear in the application list on the communication control console.
Which two statements are true about this situation? (Choose two.)
- A . The application has not made any connection attempts
- B . The application is allowed in all communication control policies.
- C . The application is ignored because its reputation score is acceptable to the security policy.
- D . The application is blocked by the security policies.
What action does an on-premises reputation server take when it receives a hash request that is not found in its local database?
- A . Automatically blocks applications with unknown hashes
- B . Ignores them until manually updated
- C . Requests the missing hashes from the cloud reputation service
- D . Stores them locally and waits for endpoint input
When implementing an application block policy in FortiEDR, which three actions, in order, reflect the correct operational sequence?
Select an action in the left column and hold and drag it to a blank position in the column on the right. Place the three correct actions in order, starting with the first action at the top of the column. After you place an action, you can move it again if you want to change your answer before proceeding to the next question. You must drop three actions in the work area.
Select and drag the screen divider to change the viewable area of the source and work areas.
A playbook is configured to block a file hash on the network through the FortiGate connector, and then isolate the device that generated the malicious hash event.
What is the expected behavior if FortiGate is unreachable?
- A . The playbook isolates the device and generates a success status.
- B . The playbook pauses execution and generates a pending status.
- C . The playbook isolates the device and generates a fail status.
- D . The playbook stops execution and generates a fail status.