Fortinet Fortinet Certifications NSE5_EDR-5.0 Questions & Answers

• Question 21:

  FortiXDR relies on which feature as part of its automated extended response?

  A. Playbooks

  B. Security Policies

  C. Forensic

  D. Communication Control

  Correct Answer: A

• Question 22:

  The FortiEDR axe classified an event as inconclusive, out a few seconds later FCS revised the classification to malicious.

  What playbook actions ate applied to the event?

  A. Playbook actions applied to inconclusive events

  B. Playbook actions applied to handled events

  C. Playbook actions applied to suspicious events

  D. Playbook actions applied to malicious events

  Correct Answer: D

• Question 23:

  Which two statements are true about the remediation function in the threat hunting module? (Choose two.)

  A. The file is removed from the affected collectors

  B. The threat hunting module sends the user a notification to delete the file

  C. The file is quarantined

  D. The threat hunting module deletes files from collectors that are currently online.

  Correct Answer: AD

• Question 24:

  Refer to the exhibit.

  

  Based on the event exception shown in the exhibit which two statements about the exception are true? (Choose two)

  A. A partial exception is applied to this event

  B. FCS playbooks is enabled by Fortinet support

  C. The exception is applied only on device C8092231196

  D. The system owner can modify the trigger rules parameters

  Correct Answer: AC

• Question 25:

  Refer to the exhibit.

  

  Based on the threat hunting query shown in the exhibit which of the following is true?

  A. RDP connections will be blocked and classified as suspicious

  B. A security event will be triggered when the device attempts a RDP connection

  C. This query is included in other organizations

  D. The query will only check for network category

  Correct Answer: B

• Question 26:

  Refer to the exhibits.

  

  

  The exhibits show application policy logs and application details Collector C8092231196 is a member of the Finance group What must an administrator do to block the FileZilia application?

  A. Deny application in Finance policy

  B. Assign Finance policy to DBA group

  C. Assign Finance policy to Default Collector Group

  D. Assign Simulation Communication Control Policy to DBA group

  Correct Answer: B

• Question 27:

  Refer to the exhibits.

  

  The exhibits show the collector state and active connections. The collector is unable to connect to aggregator IP address 10.160.6.100 using default port. Based on the netstat command output what must you do to resolve the connectivity issue?

  A. Reinstall collector agent and use port 443

  B. Reinstall collector agent and use port 8081

  C. Reinstall collector agent and use port 555

  D. Reinstall collector agent and use port 6514

  Correct Answer: B

• Question 28:

  What is the benefit of using file hash along with the file name in a threat hunting repository search?

  A. It helps to make sure the hash is really a malware

  B. It helps to check the malware even if the malware variant uses a different file name

  C. It helps to find if some instances of the hash are actually associated with a different file

  D. It helps locate a file as threat hunting only allows hash search

  Correct Answer: B

• Question 29:

  An administrator needs to restrict access to the ADMINISTRATION tab in the central manager for a specific account. What role should the administrator assign to this account?

  A. Admin

  B. User

  C. Local Admin

  D. REST API

  Correct Answer: B

• Question 30:

  Exhibit.

  

  

  Based on the forensics data shown in the exhibit which two statements are true? (Choose two.)

  A. The device cannot be remediated

  B. The event was blocked because the certificate is unsigned

  C. Device C8092231196 has been isolated

  D. The execution prevention policy has blocked this event.

  Correct Answer: AD