Fortinet NSE 6 - FortiEDR 7.0 Administrator (NSE6_EDR_AD-7.0) Free Practice Test

Question 1

A collector triggers a suspicious security incident that is initially flagged as potentially malicious. The environment is connected to the FortiEDR Cloud Service (FCS) for classification. How does FCS process the event for accurate classification? (Choose one answer)

A. By relying solely on the FortiGate firewall policies

B. By correlating collector logs only

C. By comparing the event against only local signatures

D. By data processing, comprehensive automated analysis, and comprehensive manual analysis

Correct Answer: D

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Question 2

Refer to the exhibit.

An event exception is shown. Which two statements about the exception are true? (Choose two answers)

A. A partial exception is applied to this event.

B. FCS playbooks are enabled by Fortinet support.

C. The exception is applied only on device C8092231196.

D. The system owner can modify the trigger rules parameters.

Correct Answer: B,D

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Question 3

Refer to the exhibits.

The application policy logs and application details are shown. Collector C8092231196 is a member of the Finance group. In this scenario, what must you do to block the FileZilla application? (Choose one answer)

A. Assign the Simulation Communication Control Policy to the DBA group.

B. Deny the application in the Finance policy.

C. Assign the Finance policy to the DBA group.

D. Assign the Finance policy to a broader collector group, such as the Default Collector Group.

Correct Answer: B

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Question 4

Refer to the exhibits.

You are attempting to move a collector into the High Security Collector Group for isolation but encounter an error in the API request as shown in the exhibit. To successfully isolate the collector, which API parameter must you correct? (Choose one answer)

A. Change the HTTP method in the request from PUT to POST.

B. Set the organization parameter to Default.

C. Set the target collector group parameter to Engineering group.

D. Update the authorization credentials in the API header.

Correct Answer: B

Explanation: Only visible for TestSimulate members. You can sign-up / login (it's free).

Welcome to TestSimulate

Fortinet NSE 6 - FortiEDR 7.0 Administrator (NSE6_EDR_AD-7.0) Free Practice Test