SINGLE CHOICEYour organization has deployed FortiEDR 7.0 across 500 endpoints distributed across three geographical regions, each with its own security team. You need to implement a multi-tenancy structure that allows each regional team to manage their endpoints independently while maintaining centralized visibility at the corporate level. Which approach best satisfies these requirements?
Answer(s): B
FortiEDR 7.0 multi-tenancy supports creating child organizations under a parent organization, which allows for complete administrative and data isolation while maintaining hierarchical reporting. Each child organization (tenant) functions as a separate administrative domain with its own policies, users, and visibility controls, while the parent organization retains the ability to view all child organization data and metrics. This design satisfies both independent management and centralized visibility requirements.The other options fail because: deploying separate instances eliminates centralized control; Security Fabric is designed for cross-product integration, not organizational segmentation; and IP-based restrictions do not provide proper multi-tenancy isolation or RBAC enforcement.
SINGLE CHOICEYou are configuring a communication control policy in FortiEDR to restrict lateral movement within your network. You need to prevent endpoints from establishing outbound connections to known command-an--control (C2) servers while still allowing legitimate business traffic. Which policy component should you configure to define the destination restrictions?
Communication control policies in FortiEDR allow you to define granular rules that restrict outbound connections based on destination criteria including IP addresses, domain names, and ports. These rules are enforced at the endpoint level, preventing connections before they are established, which is critical for blocking C2 communications.The other options are incorrect because: Exploit Prevention is for memory-based attacks, not network restrictions; Security Fabric rules operate at the network perimeter and do not enforce endpoint-level communication controls; and Forensics is for post-event investigation, not real-time prevention.
SINGLE CHOICEWhile investigating a suspected data exfiltration incident, you use FortiEDR's threat hunting capabilities to search for endpoints that accessed sensitive files in your data repository. You have configured a scheduled query to run daily and send alerts when the threshold of file access events exceeds 50 per hour. The next morning, you receive an alert but notice the query has returned results for endpoints that legitimately access these files as part of normal backup operations. What should you do to refine your threat hunting profile?
Answer(s): C
Threat hunting profiles in FortiEDR 7.0 allow you to define exclusion conditions and process/account filters within the query logic. Refining the profile to exclude known benign activities—such as backup service accounts or legitimate administrative processes—significantly reduces false positives while preserving the ability to detect actual anomalies. This is the proper tuning approach for scheduled queries.The other options are suboptimal because: disabling scheduled queries eliminates continuous monitoring; simply raising the threshold may miss genuine threats; and while SIEM integration is valuable, it does not address the root cause of false positives at the detection layer.
SINGLE CHOICEYou are deploying FortiXDR alongside your FortiEDR 7.0 infrastructure to provide extended detection and response across multiple Fortinet products. During the integration setup, you need to configure how FortiEDR will correlate security events with data from your FortiGate firewall and FortiProxy. Which integration method does FortiXDR use to collect and correlate events from these products?
Answer(s): A
FortiXDR integrates with FortiEDR and other Fortinet products by collecting events and logs through standard log ingestion methods (including syslog, API integrations, and connectors). FortiXDR then performs correlation analysis across the ingested events from multiple products to identify complex, multi-stage attack patterns that would not be evident within a single product's visibility.The other options are incorrect because: FortiXDR does not rely solely on machine learning correlation without human-tunable rules; FortiEDR events are one input among many, not the only data source; agent installation on appliances is not required for log collection; and FortiXDR's value lies in cross-product correlation, not just aggregation.
FILL IN THE BLANKYou are troubleshooting a FortiEDR 7.0 installation where the Fortinet Cloud Service (FCS) connection is failing, and endpoints are unable to receive threat intelligence updates. You check the diagnostic logs and notice that outbound HTTPS traffic on port 443 is being blocked by your perimeter firewall. After allowing this traffic, you need to verify that the endpoint agents can successfully connect to FCS. What command or diagnostic tool should you use on an endpoint to verify that the FortiEDR agent is able to communicate with the Fortinet Cloud Service?
In FortiEDR 7.0, the endpoint agent status and connectivity can be verified using command-line tools such as forticlient-info (on Windows) or fectl status (on Linux systems). These tools display the current agent status, including FCS connectivity, and will show whether the cloud service connection is active and recent update timestamps.While netstat or tcpdump could show network connectivity, they do not provide FortiEDR-specific agent status. The FortiEDR management console also displays endpoint status, but the question asks for an endpoint-level verification tool. Administrative event logs or syslog may contain connection errors, but the dedicated diagnostic commands are the proper way to verify agent health and FCS connectivity.
SINGLE CHOICEDuring a forensics investigation of a detected ransomware incident on an endpoint, you review the timeline of events in the FortiEDR forensics module and identify that a legitimate user account executed a suspicious PowerShell script that began encrypting files 10 minutes later. You want to understand how the script was delivered and executed. Which forensics analysis feature should you use to trace the execution chain and identify the parent process that launched the malicious PowerShell command?
The FortiEDR forensics module includes a process execution chain (or process tree) feature that displays parent-child relationships between processes. This allows investigators to trace how a malicious process was initiated and understand the complete execution context. In this scenario, viewing the process tree would show what process executed the PowerShell command (e.g., explorer.exe, outlook.exe, a browser, etc.), which is critical for understanding the attack vector.The other options are insufficient because: file hash lookup tells you about threat intelligence but not execution origin; behavior analysis helps with future prevention, not past investigation; and while network analysis is valuable, it does not explain how the script was executed locally—the process chain does.
MULTIPLE CHOICEAn employee leaves the company and no longer has access to the FortiEDR system. You must ensure GDPR compliance regarding the employee's personal data stored in FortiEDR. Which two data types must be removed to meet GDPR requirements? (Choose two answers)
Answer(s): A,D
The correct answers are A. Device and user name and D. IP address and MAC address.The FortiEDR 7.0.0 Administration Guide states that the GDPR feature is implemented in Administration > Settings > Personal Data Handling. It is used to remove relevant data for an employee or FortiEDR user who no longer has access to or uses the FortiEDR system. The guide explicitly identifies the personal data as device name, IP address, MAC address, and user name. It further states: ''You must remove all device name, IP address, MAC address, and user name data from FortiEDR in order to fully comply with the GDPR standard.''Therefore, installed applications and installed OS name are not the required GDPR personal data types in this FortiEDR procedure. The required removal is performed iteratively for the employee's/user's device name, IP address, MAC address, and user name. The guide also instructs administrators to continue removing the other required data: IP address, MAC address, and user name, and to delete any reports that may contain the user's data.
MULTIPLE CHOICEWhich two statements correctly describe the IoT probing process on FortiEDR? (Choose two answers)
Answer(s): B,C
The correct answers are B and C.The FortiEDR 7.0.0 Administration Guide explains that IoT device discovery continuously identifies newly connected non-workstation devices, such as printers, cameras, and media devices. During discovery, each relevant Collector periodically probes nearby neighboring devices. The guide states that nearby devices usually respond by providing information about themselves, including the device/host name and IP address. This directly supports option B.Option C is also correct because the guide states that Collectors in degraded, disabled, or isolated states do not take part in the IoT probing process. It also says FortiEDR uses the most powerful Collectors in each subnet and excludes weaker Collectors, including disabled and degraded Collectors.Option A is wrong because the guide explicitly says Collectors running on servers do not take part in IoT probing. Option D is wrong because IoT probing is not described as deep packet inspection of all neighboring traffic; it is a discovery/probing process used to identify nearby devices and collect basic device information.
Share your comments for Fortinet NSE6_EDR_AD-7.0 exam with other users:
please help us with 1z0-1107-2 dumps
please upload the practice questions
need this dumps
preparing for this exam is overwhelming. you cannot pass without the help of these exam dumps.
new to this site but i feel it is good
the correct answer to q8 is b. explanation since the mule app has a dependency, it is necessary to include project modules and dependencies to make sure the app will run successfully on the runtime on any other machine. source code of the component that the mule app is dependent of does not need to be included in the exported jar file, because the source code is not being used while executing an app. compiled code is being used instead.
good questions
Delayed the exam until December 29th.
A and D are True
good one with explanation
This is one of the most useful study guides I have ever used.