Online Access Free NSE6_EDR_AD-7.0 Exam Questions

A company requires a global communication policy for a FortiEDR multi-tenant environment. Which recommendation must you make? (Choose one answer)

• A.Create a new communication control policy and assign it globally to all organizations.
• B.Create a new communication control policy and delegate it to other organizations.
• C.Create a new communication control policy and apply it to multiple organizations.
• D.Create a separate communication control policy for each organization.

A playbook is configured with two actions: terminate process and isolate device. The terminate process action fails because the process is protected by Windows. What is the expected behavior for the second action, isolate device? (Choose one answer)

• A.The playbook execution pauses and requires administrator intervention.
• B.The playbook generates a notification email and execution stops.
• C.The playbook execution stops because the action fails.
• D.The playbook continues and executes the second action.

Refer to the exhibit.

Based on the exhibit, which two observations are true? (Choose two answers)

• A.This incident has been resolved.
• B.FCS has classified this as malicious.
• C.FortiEDR has classified this as suspicious.
• D.EDR has never encountered this malware before.

Refer to the Exhibit:

Based on the event shown in the exhibit, which two statements about the event are true? (Choose two answers)

• A.The policy is in simulation mode.
• B.The event has been blocked.
• C.Playbooks are configured for this event.
• D.The device is moved to isolation.

A collector attempts to access a known malicious website. FortiEDR is configured for eXtended detection with FortiAnalyzer. What two roles does Fortinet Cloud Services (FCS) perform in this process? (Choose two answers)

• A.FCS correlates and analyzes the collected logs.
• B.FCS sends OS metadata to the FortiEDR manager.
• C.FCS sends a log record to FortiAnalyzer.
• D.FCS identifies if a malicious event has taken place and reports the detection incident.