Home / Fortinet / NSE5_EDR-5.0

Fortinet NSE5_EDR-5.0 Practice Test - Questions Answers

Question list

List of questions

Question 1

(0)

What is the purpose of the Threat Hunting feature?

Question 2

(0)

How does FortiEDR implement post-infection protection?

Question 3

(0)

Exhibit. Based on the forensics data shown in the exhibit which two statements are true? (Choose two.)

Question 4

(0)

What is the benefit of using file hash along with the file name in a threat hunting repository search?

Question 5

(0)

Exhibit. Based on the event shown in the exhibit which two statements about the event are true? (Choose two.)

Question 6

(0)

An administrator needs to restrict access to the ADMINISTRATION tab in the central manager for a specific account. What role should the administrator assign to this account?

Question 7

(0)

Refer to the exhibit. Based on the event shown in the exhibit, which two statements about the event are true? (Choose two.)

Question 8

(0)

Refer to the exhibits. The exhibits show the collector state and active connections. The collector is unable to connect to aggregator IP address 10.160.6.100 using default port. Based on the n

Question 9

(0)

Refer to the exhibits. The exhibits show application policy logs and application details Collector C8092231196 is a member of the Finance group What must an administrator do to block the FileZi

Question 10

(0)

Refer to the exhibit. Based on the threat hunting query shown in the exhibit which of the following is true?

Question 1

What is the purpose of the Threat Hunting feature?

Delete any file from any collector in the organization

Find and delete all instances of a known malicious file or hash in the organization

Identify all instances of a known malicious file or hash and notify affected users

Execute playbooks to isolate affected collectors in the organization

Show Answer Comment (0)

Question 2

How does FortiEDR implement post-infection protection?

By preventing data exfiltration or encryption even after a breach occurs

By using methods used by traditional EDR

By insurance against ransomware

By real-time filtering to prevent malware from executing

Show Answer Comment (0)

Question 3

Exhibit.

Based on the forensics data shown in the exhibit which two statements are true? (Choose two.)

The device cannot be remediated

The event was blocked because the certificate is unsigned

Device C8092231196 has been isolated

The execution prevention policy has blocked this event.

Show Answer Comment (0)

Question 4

What is the benefit of using file hash along with the file name in a threat hunting repository search?

It helps to make sure the hash is really a malware

It helps to check the malware even if the malware variant uses a different file name

It helps to find if some instances of the hash are actually associated with a different file

It helps locate a file as threat hunting only allows hash search

Show Answer Comment (0)

Question 5

Exhibit.

Based on the event shown in the exhibit which two statements about the event are true? (Choose two.)

The device is moved to isolation.

Playbooks is configured for this event.

The event has been blocked

The policy is in simulation mode

Show Answer Comment (0)

Question 6

An administrator needs to restrict access to the ADMINISTRATION tab in the central manager for a specific account.

What role should the administrator assign to this account?

Admin

User

Local Admin

REST API

Show Answer Comment (0)

Question 7

Refer to the exhibit.

Based on the event shown in the exhibit, which two statements about the event are true? (Choose two.)

The NGAV policy has blocked TestApplication exe

TestApplication exe is sophisticated malware

The user was able to launch TestApplication exe

FCS classified the event as malicious

Show Answer Comment (0)

Question 8

Refer to the exhibits.

The exhibits show the collector state and active connections. The collector is unable to connect to aggregator IP address 10.160.6.100 using default port.

Based on the netstat command output what must you do to resolve the connectivity issue?

Reinstall collector agent and use port 443

Reinstall collector agent and use port 8081

Reinstall collector agent and use port 555

Reinstall collector agent and use port 6514

Show Answer Comment (0)

Question 9

Refer to the exhibits.

The exhibits show application policy logs and application details Collector C8092231196 is a member of the Finance group What must an administrator do to block the FileZilia application?

Deny application in Finance policy

Assign Finance policy to DBA group

Assign Finance policy to Default Collector Group

Assign Simulation Communication Control Policy to DBA group

Show Answer Comment (0)