Online Access Free NSE6_EDR_AD-7.0 Exam Questions

Refer to the Exhibit:

Based on the investigation view shown in the exhibit, which two statements about this event are true? (Choose two answers)

• A.The raw data is displayed in the stacks view.
• B.The exfiltration prevention policy blocked this event.
• C.The device has been isolated.
• D.An exception was created for this incident.

Refer to the Exhibit:

Based on the event shown in the exhibit, which two statements about the event are true? (Choose two answers)

• A.The device is moved to isolation.
• B.The event has been blocked.
• C.Playbooks are configured for this event.
• D.The policy is in simulation mode.

Which two Python commands are supported when using FortiEDR Connect to directly access a protected device shell? (Choose two answers)

• A.%psexec
• B.%upload_file
• C.%ipconfig_all
• D.%timestamp

A playbook is configured with two actions: terminate process and isolate device. The terminate process action fails because the process is protected by Windows. What is the expected behavior for the second action, isolate device? (Choose one answer)

• A.The playbook execution stops because the action fails.
• B.The playbook generates a notification email and execution stops.
• C.The playbook continues and executes the second action.
• D.The playbook execution pauses and requires administrator intervention.

A playbook is configured to block a file hash on the network through the FortiGate connector, and then isolate the device that generated the malicious hash event.
What is the expected behavior if FortiGate is unreachable?

• A.The playbook stops execution and generates a fail status.
• B.The playbook isolates the device and generates a success status.
• C.The playbook isolates the device and generates a fail status.
• D.The playbook pauses execution and generates a pending status.