Free Fortinet NSE6_EDR_AD-7.0 Exam Dumps Questions & Answers

Refer to the exhibit.

Based on the exhibit, which two observations are true? (Choose two answers)

• A.  FCS has classified this as malicious.
• B.  FortiEDR has classified this as suspicious.
• C.  EDR has never encountered this malware before.
• D.  This incident has been resolved.

A company requires a global communication policy for a FortiEDR multi-tenant environment. Which recommendation must you make? (Choose one answer)

• A.  Create a new communication control policy and delegate it to other organizations.
• B.  Create a separate communication control policy for each organization.
• C.  Create a new communication control policy and apply it to multiple organizations.
• D.  Create a new communication control policy and assign it globally to all organizations.

Refer to the exhibits.

You are attempting to move a collector into the High Security Collector Group for isolation but encounter an error in the API request as shown in the exhibit. To successfully isolate the collector, which API parameter must you correct? (Choose one answer)

• A.  Set the organization parameter to Default.
• B.  Change the HTTP method in the request from PUT to POST.
• C.  Update the authorization credentials in the API header.
• D.  Set the target collector group parameter to Engineering group.

Refer to the Exhibit:

A FortiEDR analyst is prioritizing response efforts. One application has a vulnerability score of Critical but an Unknown ACI rating, while another has a Medium vulnerability score with active ACI evidence of adversary targeting. Which application must be addressed first? (Choose one answer)

• A.  The application with the Critical vulnerability score should be addressed first.
• B.  Both applications should be treated equally because patching is necessary.
• C.  The decision depends only on asset criticality, not scores.
• D.  The application with the Medium vulnerability score and ACI evidence should be addressed first.

Refer to the exhibit.

Based on the exhibit, which statement about this threat hunting query is true? (Choose one answer)

• A.  A security incident will be generated whenever the device attempts an RDP connection.
• B.  The query is configured as a global hunting rule and is automatically visible across all organizations.
• C.  The query is limited to detecting network activity and does not inspect process behavior.
• D.  RDP connections will be automatically blocked and classified as suspicious.