Fortinet Network Security Analyst NSE5_FCT-7.0 Questions & Answers

• Question 1:

  Refer to the exhibit.

  

  Based on the settings shown in the exhibit what action will FortiClient take when it detects that a user is trying to download an infected file?

  A. Blocks the infected files as it is downloading

  B. Quarantines the infected files and logs all access attempts

  C. Sends the infected file to FortiGuard for analysis

  D. Allows the infected file to download without scan

  Correct Answer: D

• Question 2:

  Why does FortiGate need the root CA certificate of FortiClient EMS?

  A. To sign FortiClient CSR requests

  B. To revoke FortiClient client certificates

  C. To trust certificates issued by FortiClient EMS

  D. To update FortiClient client certificates

  Correct Answer: C

• Question 3:

  Refer to the exhibit.

  

  Based on the FortiClient logs shown in the exhibit which endpoint profile policy is currently applied to the FortiClient endpoint from the EMS server?

  A. Default

  B. Compliance rules default

  C. Fortinet- Training

  D. Default configuration policy

  Correct Answer: C

• Question 4:

  Refer to the exhibit.

  

  Based on the FortiClient log details shown in the exhibit, which two statements are true? (Choose two.)

  A. The file status is Quarantined

  B. The filename is sent to ForuSandbox for further inspection.

  C. The file location IS \??\D:\Users\.

  D. The filename is Unconfirmed 899290 .crdownload.

  Correct Answer: AD

• Question 5:

  Refer to the exhibits.

  

  Which show the Zero Trust Tag Monitor and the FortiClient GUI status.

  Remote-Client is tagged as Remote-Users on the FortiClient EMS Zero Trust Tag Monitor.

  What must an administrator do to show the tag on the FortiClient GUI?

  A. Update tagging rule logic to enable tag visibility

  B. Change the FortiClient system settings to enable tag visibility

  C. Change the endpoint control setting to enable tag visibility

  D. Change the user identity settings to enable tag visibility

  Correct Answer: B

• Question 6:

  An administrator is required to maintain a software inventory on the endpoints. without showing the feature on the FortiClient dashboard What must the administrator do to achieve this requirement?

  A. The administrator must use default endpoint profile

  B. The administrator must not select the vulnerability scan feature in the deployment package.

  C. The administrator must select the vulnerability scan feature in the deployment package, but disable the feature on the endpoint profile

  D. The administrator must click the hide icon on the vulnerability scan tab

  Correct Answer: D

• Question 7:

  Which two statements are true about ZTNA? (Choose two.)

  A. ZTNA provides role-based access

  B. ZTNA manages access for remote users only

  C. ZTNA manages access through the client only

  D. ZTNA provides a security posture check

  Correct Answer: AD

• Question 8:

  Refer to the exhibit.

  

  Based on the settings shown in the exhibit which statement about FortiClient behavior is true?

  A. FortiClient quarantines infected files and reviews later, after scanning them.

  B. FortiClient blocks and deletes infected files after scanning them.

  C. FortiClient scans infected files when the user copies files to the Resources folder

  D. FortiClient copies infected files to the Resources folder without scanning them.

  Correct Answer: A

• Question 9:

  Which two third-party tools can an administrator use to deploy FortiClient? (Choose two.)

  A. Microsoft Windows Installer

  B. Microsoft SCCM

  C. Microsoft Active Directory GPO

  D. QR code generator

  Correct Answer: BC

• Question 10:

  What action does FortiClient anti-exploit detection take when it detects exploits?

  A. Blocks memory allocation to the compromised application process

  B. Patches the compromised application process

  C. Deletes the compromised application process

  D. Terminates the compromised application process

  Correct Answer: D

  The anti-exploit detection protects vulnerable endpoints from unknown exploit attacks. FortiClient monitors the behavior of popular applications, such as web browsers (Internet Explorer, Chrome, Firefox, Opera), Java/Flash plug-ins, Microsoft Office applications, and PDF readers, to detect exploits that use zero-day or unpatched vulnerabilities to infect the endpoint. Once detected, FortiClient terminates the compromised application process.