MULTIPLE CHOICEYou added three new applications to FortiEDR using only the Path attribute. What are two expected outcomes of this configuration? (Choose two answers)
Answer(s): A,B
The correct answers are A and B.The FortiEDR 7.0.0 Administration Guide states that newly added applications are disabled by default, which means they are not blocked unless enabled. The guide further explains that the default state can be changed by enabling the Enable Default application state option in the Application Control Manager settings. Therefore, option A is correct.Option B is also correct because Application Control allows an application to be defined by Hash or by any combination of File Name / Path / Signer. The guide says that the Path field specifies the path to the executable file of the application to be blocked. When using path-based matching, the enforcement is tied to the specified path criteria, not to every possible location of the same file.Option C is wrong because the file name does not also need to match when only the Path attribute is used. Option D is wrong because blocking all instances regardless of location applies when only the File Name field is used, not when the match is path-specific. The guide explicitly states that if only the File Name field is filled, the application is blocked no matter where the executable appears.
MULTIPLE CHOICEYou find third-party software on a user's computer that does not appear in the application list on the communication control console. Which two statements are true about this situation? (Choose two answers)
Answer(s): A,D
The best answers are A and D, but be careful: A is directly verified by the guide; D is the only remaining statement that can be true in policy context, but it is weaker than A.The FortiEDR 7.0.0 Administration Guide states that the Communication Control tab identifies communicating applications detected in the organization. More specifically, the Applications page lists ''all communicating applications detected in your organization that have ever attempted to communicate.'' Therefore, if software exists on a user's computer but does not appear in the Communication Control application list, the most direct explanation is that it has not attempted external communication.The guide also explains that FortiEDR Communication Control reduces the scope of administration because Security/IT only needs to handle applications that communicate externally. It also states that non-authorized applications can still execute, and only their outgoing communication is prevented. This confirms that the Communication Control application list is not a full software inventory; it is a list of applications that have communicated or attempted communication.Option B is not correct. If an application were blocked due to FortiEDR security-policy enforcement after a connection attempt, FortiEDR would generate security-event visibility in the Incidents workflow, not simply hide the application from Communication Control. FortiEDR Collectors send communication-related data for Communication Control, and security events are sent for enforcement/monitoring purposes.Option C is also wrong. Reputation score affects policy decisions and application risk evaluation, but it does not cause an application to be ignored or excluded from the application list. The guide says each application in the Applications page shows a reputation indicator, which proves reputation is displayed for listed applications rather than used to hide them.For option D, if the application has never attempted communication, Communication Control has no observed communication event to list. In exam logic, this can be interpreted as the application is not currently being denied by Communication Control policies. However, the stronger technical truth is this: Communication Control does not list installed software; it lists applications that have attempted to communicate.
SINGLE CHOICEWithin the FortiEDR architecture, which component needs JumpBox capabilities to enable authenticated and controlled communication with FortiAnalyzer? (Choose one answer)
Answer(s): A
The correct answer is A. Core.For FortiAnalyzer / FortiAnalyzer Cloud integration, the FortiEDR 7.0.0 Administration Guide states that one prerequisite is ''A Jumpbox with connectivity to FortiAnalyzer.'' The same section says to refer to Setting up the FortiEDR Core for details about installing a FortiEDR Core and configuring it as a Jumpbox. In the connector configuration, the guide also states that the Jumpbox field is used to select the FortiEDR Jumpbox that will communicate with FortiAnalyzer or FortiAnalyzer Cloud.So, the FortiEDR component associated with JumpBox capability is the Core. The Central Manager must have connectivity to Fortinet Cloud Services, but it is not the component configured as the JumpBox. The Aggregator handles registration, configuration, and monitoring between Collectors/Cores and Central Manager, and the Reputation Server is unrelated to FortiAnalyzer JumpBox communication in this context.
SINGLE CHOICEYou are asked to configure a query to run every 15 minutes, automatically searching for specific registry modifications across all endpoints. Which FortiEDR feature must you configure? (Choose one answer)
Answer(s): C
The correct answer is C.The FortiEDR guide explains that Threat Hunting searches across endpoint activity events, including registry activity. It states that Threat Hunting can search based on attributes of files, registry keys and values, network, processes, event log, and activity event types. This fits the requirement to search for specific registry modifications across endpoints.The guide also explains that after filtering activity events, the query can be saved and defined as a Scheduled Query. It says: ''Scheduled Query: Mark this option to automate the process of detecting threats so that this query is run automatically according to the schedule that you define.'' It also states that a security event is automatically created in the Incidents tab when matches are detected, and notifications can be sent through email, Syslog, and other configured methods.The guide further states that the Repeat Every/On options define the frequency and schedule when the query runs. Therefore, a 15-minute recurring query is handled through the Scheduled Query capability in Threat Hunting, not Communication Control, policy override, or a manual Playbook trigger.Strictly speaking, the guide calls this a scheduled query under Threat Hunting saved queries, not a ''communication control rule'' or ''manual query.'' Option C is the intended answer.
SINGLE CHOICEWhat specific action does FortiEDR take when the Zero Trust Device Tagging playbook is activated? (Choose one answer)
The correct answer is C.The FortiEDR 7.0.0 Administration Guide explains that Identity Management integration can use FortiClient EMS. The connector requires API credentials or FortiCloud credentials depending on whether FortiClient EMS is on-premises or cloud-based. The guide states that for the out-of-the-box action, such as Zero Trust device tagging on FortiClient EMS, FortiEDR tags the device as non-trusted in the identity management system and specifies the classification tag to apply in the Tag name field.The guide also lists predefined FortiClient EMS 7.2 or later fabric tags used by FortiEDR, including FortiEDR_Malicious, FortiEDR_PUP, FortiEDR_Suspicious, FortiEDR_Likely_Safe, and FortiEDR_Probably_Good. These tags are used by FortiClient EMS to tag the endpoint based on FortiEDR classification.Finally, the guide states that to configure the automated response, the administrator must go to Security Settings > Playbooks, open the relevant Playbook policy, and place a checkmark in the relevant classification column next to the Zero Trust device tagging row under Remediation. FortiEDR is then configured to automatically tag a device as non-trusted when a security event is triggered.Options A, B, and D are wrong. FortiEDR does not remove unmanaged endpoints, does not apply a default tag to every endpoint, and does not disable the endpoint merely until a tag is assigned. The action is API-based FortiClient EMS tagging tied to FortiEDR event classification
SINGLE CHOICEA company requires a global communication policy for a FortiEDR multi-tenant environment. Which recommendation must you make? (Choose one answer)
The correct answer is A. Create a separate communication control policy for each organization.The key point is that Communication Control is not available in Hoster view. In a FortiEDR multi-tenant environment, Hoster view is the view used to display information for all organizations together. However, the guide clearly states under the Hoster view section: ''Communication Control --- The Communication Control window is not available in Hoster view.''That means you cannot create one global Communication Control policy from Hoster view and assign it across all organizations. Options B, C, and D all assume cross-organization/global Communication Control policy assignment, but the guide does not support that capability. The practical recommendation is to configure Communication Control policies separately inside each organization.The guide contrasts this with Security Policies, where in Hoster view the Security Policies page displays all policies from all organizations and supports cloning a security policy from one organization to another. That statement is for Security Policies, not Communication Control policies.
SINGLE CHOICEYou are asked to create a playbook to isolate a device with a collector. Which action category does isolating a device with a collector fall under? (Choose one answer)
The correct answer is A. Investigation.The FortiEDR 7.0.0 Administration Guide states that Investigation actions enable administrators to isolate a device or assign it to a high-security Collector Group for further investigation of the device's activity. Under the Investigation section, the guide lists the available investigation action types, including ''Isolate device with Collector,'' ''Isolate device with NAC,'' and ''Move device to High Security Group.''For Isolate device with Collector, the guide explains that the action blocks communication to and from the affected Collector, and it applies only to endpoint Collectors. If the Playbook policy is configured to isolate a device for a malicious event, then when a malicious security event is triggered, the device is isolated from communicating with the outside world for both sending and receiving.So, this is not a Remediation, Custom, or Notification action. In FortiEDR Playbook policy terminology, Isolate device with Collector belongs under Investigation.
SINGLE CHOICERefer to the exhibits.What happens when the net user command runs on an endpoint? (Choose one answer)
The correct answer is C.The exhibit shows a Threat Hunting saved query named CLI Command with the query:Target.Process.Filename ('net.exe')It is configured as a Scheduled Query, classified as Suspicious, and set to repeat every 15 minutes. The FortiEDR guide states that saving a Threat Hunting query allows it to be defined as a scheduled query to automate threat detection. When the scheduled query runs and detects matching activity, a security event is automatically created in the Incidents tab.The guide also states that scheduled queries run automatically according to the configured schedule, and each time a match is detected, FortiEDR generates a security event in the Incidents tab and sends notifications according to the security event configuration.So, when the endpoint runs:net user edruser password! /ADDFortiEDR records the relevant process activity, and when the scheduled query runs, it matches the target process net.exe and creates an incident/security event. It is not immediate by default because the query is scheduled every 15 minutes. It also does not block CLI commands by default unless playbook actions or policy controls are configured. The activity is treated according to the saved query classification, which in the exhibit is Suspicious.
Share your comments for Fortinet NSE6_EDR_AD-7.0 exam with other users:
cosmos db is paas not saas
what is the percentage of common questions in gcp exam compared to 197 dump questions? are they 100% matching with real gcp exam?
not able to see questions
by far one of the best sites for free questions. i have pass 2 exams with the help of this website.
excellent question bank.
it really helped
excelent material
the new versoin of this exam which i downloaded has all the latest questions from the exam. i only saw 3 new questions in the exam which was not in this dump.
question 8 - can cloudtrail be used for storing jobs? based on aws - aws cloudtrail is used for governance, compliance and investigating api usage across all of our aws accounts. every action that is taken by a user or script is an api call so this is logged to [aws] cloudtrail. something seems incorrect here.
question 13 tda - c01 answer : quick table calculation -> percentage of total , compute using table down
pls share teh dump
question 44 answer is user risk
please post the questions for preparation
thanks for the questions
please reopen it now ..its really urgent
these practice exam questions were exactly what i needed. the variety of questions and the realistic exam-like environment they created helped me assess my strengths and weaknesses. i felt more confident and well-prepared on exam day, and i owe it to this exam dumps!
thank u it very instructuf
its helpful?
is this dump still valid???
question 205 answer is b
question 39, should be answer b, directions stated is being sudneted from /21 to a /23. a /23 has 512 ips so 510 hosts. and can make 4 subnets out of the /21
beautiful test engine software and very helpful. questions are same as in the real exam. i passed my paper.
the questions are exactly the same in real exam. just make sure not to answer all them correct or else they suspect you are cheating.
question: 78 the right answer i think is d not a
very helpful
i am writing this exam tomorrow and have dumps
can i have the icdl excel exam
please upload it
hye when will post again the past year question for this h13-311_v3 part since i have to for my test tommorow…thank you very much
on question 22, option b-once per session is also valid.
this website is very helpful
its my first time exam
correct answers are device configuration-enable the automatic installation of webview2 runtime. & policy management- prevent users from submitting feedback.
is this dump still valid? today is 9-july-2023
Keeping this site free takes real effort. We constantly battle automated scraping and unauthorized content copying. A quick account helps us protect the community and keep the site free.
To continue studying for your NSE6_EDR_AD-7.0, please sign in or create a free account.