Fortinet NSE5_EDR-5.0 Online Practice Questions and Exam Preparation

Fortinet NSE5_EDR-5.0 Online Questions & Answers

• Question 1:

  Refer to the exhibit.

  

  Based on the FortiEDR status output shown in the exhibit, which two statements about the FortiEDR collector are true? (Choose two.)

  A. The collector device has windows firewall enabled
  B. The collector has been installed with an incorrect port number
  C. The collector has been installed with an incorrect registration password
  D. The collector device cannot reach the central manager
  B. The collector has been installed with an incorrect port number
  C. The collector has been installed with an incorrect registration password

• Question 2:

  Exhibit.

  

  Based on the event shown in the exhibit which two statements about the event are true? (Choose two.)

  A. The device is moved to isolation.
  B. Playbooks is configured for this event.
  C. The event has been blocked
  D. The policy is in simulation mode
  B. Playbooks is configured for this event.
  D. The policy is in simulation mode

• Question 3:

  Which statement is true about the flow analyzer view in forensics?

  A. It displays a graphic flow diagram.
  B. Two events can be compared side-by-side.
  C. It shows details about processes and sub processes.
  D. The stack memory of a specific device can be retrieved
  A. It displays a graphic flow diagram.

• Question 4:

  Which two statements about the FortiEDR solution are true? (Choose two.)

  A. It provides pre-infection and post-infection protection
  B. It is Windows OS only
  C. It provides central management
  D. It provides pant-to-point protection
  A. It provides pre-infection and post-infection protection
  C. It provides central management

• Question 5:

  Exhibit.

  

  

  Based on the forensics data shown in the exhibit which two statements are true? (Choose two.)

  A. The device cannot be remediated
  B. The event was blocked because the certificate is unsigned
  C. Device C8092231196 has been isolated
  D. The execution prevention policy has blocked this event.
  A. The device cannot be remediated
  D. The execution prevention policy has blocked this event.

• Question 6:

  How does FortiEDR implement post-infection protection?

  A. By preventing data exfiltration or encryption even after a breach occurs
  B. By using methods used by traditional EDR
  C. By insurance against ransomware
  D. By real-time filtering to prevent malware from executing
  A. By preventing data exfiltration or encryption even after a breach occurs

  ---

  Explanation/Reference:

  https://www.fortinet.com/content/dam/fortinet/assets/data-sheets/fortiedr.pdf

• Question 7:

  Refer to the exhibit.

  The exhibit shows an event viewer.

  

  What is true about the Payroll Manager.exe event?

  A. An event has not been handled by a console admin
  B. An event has been deleted
  C. A rule assigned action is set to block but the policy is in simulation mode
  D. An event has been handled by the communication control policy
  C. A rule assigned action is set to block but the policy is in simulation mode

• Question 8:

  Refer to the exhibits.

  

  

  The exhibits show application policy logs and application details Collector C8092231196 is a member of the Finance group What must an administrator do to block the FileZilia application?

  A. Deny application in Finance policy
  B. Assign Finance policy to DBA group
  C. Assign Finance policy to Default Collector Group
  D. Assign Simulation Communication Control Policy to DBA group
  B. Assign Finance policy to DBA group

• Question 9:

  Refer to the exhibits.

  

  The exhibits show the collector state and active connections. The collector is unable to connect to aggregator IP address 10.160.6.100 using default port. Based on the netstat command output what must you do to resolve the connectivity issue?

  A. Reinstall collector agent and use port 443
  B. Reinstall collector agent and use port 8081
  C. Reinstall collector agent and use port 555
  D. Reinstall collector agent and use port 6514
  B. Reinstall collector agent and use port 8081

• Question 10:

  Which two events can trigger FortiEDR NGAV policy violations? (Choose two.)

  A. When a malicious file attempts to communicate externally
  B. When a malicious file is executed
  C. When a malicious file is read
  D. When a malicious file attempts to access data
  B. When a malicious file is executed
  C. When a malicious file is read

  ---

  Explanation/Reference:

  NGAV reacts when a file is Saved, Read, or Executed Page 79 of the guide