Fortinet Fortinet Certifications NSE5_EDR-5.0 Questions & Answers

• Question 31:

  Refer to the exhibit.

  

  Based on the postman output shown in the exhibit why is the user getting an unauthorized error?

  A. The user has been assigned Admin and Rest API roles

  B. FortiEDR requires a password reset the first time a user logs in

  C. Postman cannot reach the central manager

  D. API access is disabled on the central manager

  Correct Answer: B

• Question 32:

  Which two types of remote authentication does the FortiEDR management console support? (Choose two.)

  A. Radius

  B. SAML

  C. TACACS D. LDAP

  Correct Answer: BD

• Question 33:

  Which two statements about the FortiEDR solution are true? (Choose two.)

  A. It provides pre-infection and post-infection protection

  B. It is Windows OS only

  C. It provides central management

  D. It provides pant-to-point protection

  Correct Answer: AC

• Question 34:

  Refer to the exhibit.

  

  Based on the FortiEDR status output shown in the exhibit, which two statements about the FortiEDR collector are true? (Choose two.)

  A. The collector device has windows firewall enabled

  B. The collector has been installed with an incorrect port number

  C. The collector has been installed with an incorrect registration password

  D. The collector device cannot reach the central manager

  Correct Answer: BC

• Question 35:

  What is the purpose of the Threat Hunting feature?

  A. Delete any file from any collector in the organization

  B. Find and delete all instances of a known malicious file or hash in the organization

  C. Identify all instances of a known malicious file or hash and notify affected users

  D. Execute playbooks to isolate affected collectors in the organization

  Correct Answer: B

  "Threat hunting allows management console users to find and remediate dormant threats before they execute. Essentially it's a search and destroy operation."

• Question 36:

  What is true about classifications assigned by Fortinet Cloud Sen/ice (FCS)?

  A. The core is responsible for all classifications if FCS playbooks are disabled

  B. The core only assigns a classification if FCS is not available

  C. FCS revises the classification of the core based on its database

  D. FCS is responsible for all classifications

  Correct Answer: C

• Question 37:

  Refer to the exhibit.

  

  Based on the event shown in the exhibit, which two statements about the event are true? (Choose two.)

  A. The NGAV policy has blocked TestApplication exe

  B. TestApplication exe is sophisticated malware

  C. The user was able to launch TestApplication exe

  D. FCS classified the event as malicious

  Correct Answer: BC

• Question 38:

  How does FortiEDR implement post-infection protection?

  A. By preventing data exfiltration or encryption even after a breach occurs

  B. By using methods used by traditional EDR

  C. By insurance against ransomware

  D. By real-time filtering to prevent malware from executing

  Correct Answer: A

  https://www.fortinet.com/content/dam/fortinet/assets/data-sheets/fortiedr.pdf

• Question 39:

  Which security policy has all of its rules disabled by default?

  A. Device Control

  B. Ransomware Prevention

  C. Execution Prevention

  D. Exfiltration Prevention

  Correct Answer: A

• Question 40:

  Which connectors can you use for the FortiEDR automated incident response? (Choose two.)

  A. FortiNAC

  B. FortiGate

  C. FortiSiem

  D. FortiSandbox

  Correct Answer: AB