How does FortiEDR implement post-infection protection?

By real-time filtering to prevent malware from executing

By preventing data exfiltration or encryption even after a breach occurs

By using methods used by traditional EDR

By insurance against ransomware

By real-time filtering to prevent malware from executing

Exhibit. Based on the forensics data shown in the exhibit which two statements are true? (Choose two.)

The event was blocked because the certificate is unsigned

Device C8092231196 has been isolated

The device cannot be remediated

The event was blocked because the certificate is unsigned

Device C8092231196 has been isolated

The execution prevention policy has blocked this event.

What is the benefit of using file hash along with the file name in a threat hunting repository search?

It helps to find if some instances of the hash are actually associated with a different file

It helps to make sure the hash is really a malware

It helps to check the malware even if the malware variant uses a different file name

It helps to find if some instances of the hash are actually associated with a different file

It helps locate a file as threat hunting only allows hash search

Exhibit. Based on the event shown in the exhibit which two statements about the event are true? (Choose two.)

Playbooks is configured for this event.

The policy is in simulation mode

The device is moved to isolation.

Playbooks is configured for this event.

The policy is in simulation mode

Refer to the exhibit. Based on the event shown in the exhibit, which two statements about the event are true? (Choose two.)

The NGAV policy has blocked TestApplication exe

TestApplication exe is sophisticated malware

The NGAV policy has blocked TestApplication exe

TestApplication exe is sophisticated malware

The user was able to launch TestApplication exe

FCS classified the event as malicious

Refer to the exhibits. The exhibits show the collector state and active connections. The collector is unable to connect to aggregator IP address 10.160.6.100 using default port.Based on the netstat command output what must you do to resolve the connectivity issue?

Reinstall collector agent and use port 8081

Reinstall collector agent and use port 443

Reinstall collector agent and use port 8081

Reinstall collector agent and use port 555

Reinstall collector agent and use port 6514

Refer to the exhibits. The exhibits show application policy logs and application details Collector C8092231196 is a member of the Finance group What must an administrator do to block the FileZilia application?

Assign Simulation Communication Control Policy to DBA group

Deny application in Finance policy

Assign Finance policy to DBA group

Assign Finance policy to Default Collector Group

Assign Simulation Communication Control Policy to DBA group

Refer to the exhibit. Based on the threat hunting query shown in the exhibit which of the following is true?

A security event will be triggered when the device attempts a RDP connection

RDP connections will be blocked and classified as suspicious

A security event will be triggered when the device attempts a RDP connection

This query is included in other organizations

The query will only check for network category

What is true about classifications assigned by Fortinet Cloud Sen/ice (FCS)?

FCS revises the classification of the core based on its database

The core is responsible for all classifications if FCS playbooks are disabled

The core only assigns a classification if FCS is not available

FCS revises the classification of the core based on its database

FCS is responsible for all classifications

Refer to the exhibit. Based on the FortiEDR status output shown in the exhibit, which two statements about the FortiEDR collector are true? (Choose two.)

The collector has been installed with an incorrect port number

The collector device cannot reach the central manager

The collector device has windows firewall enabled

The collector has been installed with an incorrect port number

The collector has been installed with an incorrect registration password

The collector device cannot reach the central manager

A company requires a global communication policy for a FortiEDR multi-tenant environment.How can the administrator achieve this?

A local administrator creates a new communication control policy and assigns it globally to all organizations

An administrator creates a new communication control policy and shares it with other organizations

A local administrator creates new a communication control policy and shares it with other organizations

A local administrator creates a new communication control policy and assigns it globally to all organizations

An administrator creates a new communication control policy for each organization

Refer to the exhibit. Based on the event exception shown in the exhibit which two statements about the exception are true? (Choose two)

A partial exception is applied to this event

The exception is applied only on device C8092231196

A partial exception is applied to this event

FCS playbooks is enabled by Fortinet support

The exception is applied only on device C8092231196

The system owner can modify the trigger rules parameters

Which two statements are true about the remediation function in the threat hunting module?(Choose two.)

The threat hunting module sends the user a notification to delete the file

The file is removed from the affected collectors

The threat hunting module sends the user a notification to delete the file

The threat hunting module deletes files from collectors that are currently online.

Exhibit. Based on the forensics data shown in the exhibit, which two statements are true? (Choose two.)

The exfiltration prevention policy has blocked this event

An exception has been created for this event

The forensics data is displayed m the stacks view

The exfiltration prevention policy has blocked this event

The FortiEDR axe classified an event as inconclusive, out a few seconds later FCS revised the classification to malicious. What playbook actions ate applied to the event?

Playbook actions applied to malicious events

Playbook actions applied to inconclusive events

Playbook actions applied to handled events

Playbook actions applied to suspicious events

Playbook actions applied to malicious events

Refer to the exhibit. Based on the postman output shown in the exhibit why is the user getting an unauthorized error?

The user has been assigned Admin and Rest API roles

FortiEDR requires a password reset the first time a user logs in

Postman cannot reach the central manager

API access is disabled on the central manager

What is the role of a collector in the communication control policy?

A collector blocks unsafe applications from running

A collector is used to change the reputation score of any application that collector runs

A collector records applications that communicate externally

A collector can quarantine unsafe applications from communicating

Refer to the exhibit. Based on the threat hunting event details shown in the exhibit, which two statements about the event are true? (Choose two.)

The PING EXE process was blocked

There are no MITRE details available for this event

The PING EXE process was blocked

The user fortinet has executed a ping command

The activity event is associated with the file action

There are no MITRE details available for this event

An administrator finds a third party free software on a user's computer mat does not appear in me application list in the communication control console Which two statements are true about this situation? (Choose two)

The application is allowed in all communication control policies

The application is blocked by the security policies

The application is allowed in all communication control policies

The application is ignored as the reputation score is acceptable by the security policy

The application has not made any connection attempts

The application is blocked by the security policies

A FortiEDR security event is causing a performance issue with a third-parry application. What must you do first about the event?

Immediately create an exception

Terminate the process and uninstall the third-party application

Immediately create an exception

Investigate the event to verify whether or not the application is safe

Which FortiEDR component is required to find malicious files on the entire network of an organization?

FortiEDR Threat Hunting Repository

Which two statements about the FortiEDR solution are true? (Choose two.)

It provides pre-infection and post-infection protection

It provides pant-to-point protection

It provides pre-infection and post-infection protection

It provides pant-to-point protection

Fortinet NSE5_EDR-5.0 Practice Test 1 - Free Online Exam Prep & Questions

What is the purpose of the Threat Hunting feature?

Delete any file from any collector in the organization

Find and delete all instances of a known malicious file or hash in the organization

Identify all instances of a known malicious file or hash and notify affected users

Execute playbooks to isolate affected collectors in the organization

Comment (0)

Fortinet NSE5_EDR-5.0 Practice Test 1

Question

Fortinet NSE5_EDR-5.0 Practice Tests

Practice Tests