Free Fortinet NSE6_EDR_AD-7.0 Exam Dumps Questions & Answers

Refer to the Exhibit:

A FortiEDR analyst is prioritizing response efforts. One application has a vulnerability score of Critical but an Unknown ACI rating, while another has a Medium vulnerability score with active ACI evidence of adversary targeting. Which application must be addressed first? (Choose one answer)

• A.  The application with the Critical vulnerability score should be addressed first.
• B.  Both applications should be treated equally because patching is necessary.
• C.  The decision depends only on asset criticality, not scores.
• D.  The application with the Medium vulnerability score and ACI evidence should be addressed first.

You added three new applications to FortiEDR using only the Path attribute. What are two expected outcomes of this configuration? (Choose two answers)

• A.  All instances of these applications will be blocked, regardless of location.
• B.  Only applications in the specified directory paths will be blocked.
• C.  These applications will be disabled until explicitly enabled.
• D.  These applications will be blocked only if the file name also matches.

Refer to the exhibit.

Based on the exhibit, which two observations are true? (Choose two answers)

• A.  EDR has never encountered this malware before.
• B.  This incident has been resolved.
• C.  FortiEDR has classified this as suspicious.
• D.  FCS has classified this as malicious.

What action does an on-premises reputation server take when it receives a hash request that is not found in its local database? (Choose one answer)

• A.  Ignores them until manually updated
• B.  Stores them locally and waits for endpoint input
• C.  Requests the missing hashes from the cloud reputation service
• D.  Automatically blocks applications with unknown hashes

A playbook is configured with two actions: terminate process and isolate device. The terminate process action fails because the process is protected by Windows. What is the expected behavior for the second action, isolate device? (Choose one answer)

• A.  The playbook continues and executes the second action.
• B.  The playbook generates a notification email and execution stops.
• C.  The playbook execution stops because the action fails.
• D.  The playbook execution pauses and requires administrator intervention.